WatchGuard Agent 1.17.24 Protects FileVault Recovery Keys
Tech GuruQuick Answer
WatchGuard fixed CVE-2026-96293 in WatchGuard Agent for macOS 1.17.24.0000. Inventory Full Disk Encryption endpoints, update the Agent, determine whether a readable diagnostic log exposed a FileVault recovery key, rotate affected keys under approved procedures, and retain evidence securely.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory macOS Agent versions and Full Disk Encryption use; update affected endpoints to 1.17.24.0000 or later; verify the diagnostic log no longer exposes a key; assess and rotate recovery keys when required; validate FileVault, escrow, and recovery; and retain sanitized evidence.
Last verified: 2026-10-22 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | WatchGuard Agent for macOS with Endpoint Security Full Disk Encryption |
|---|---|
| Advisory | CVE-2026-96293 |
| CVE | CVE-2026-96293 |
| Authoritative release date | 2026-10-22 |
| Authority revision date | 2026-10-22 |
| Affected versions | WatchGuard Agent for macOS versions before 1.17.24.0000 when the Full Disk Encryption feature wrote the FileVault personal recovery key to a diagnostic log readable by local users. |
| Fixed version | WatchGuard Agent 1.17.24.0000 or later |
| CVSS base score | 6.9 (CVSS v4.0) |
| CVSS severity | Medium |
| Exploitation status | WatchGuard does not state that this vulnerability is being maliciously exploited; no exploitation claim is inferred. |
What Changed
WatchGuard corrected diagnostic logging in its macOS Full Disk Encryption feature. A local unprivileged user or process could read a persistently logged FileVault personal recovery key on a vulnerable managed computer.
What To Validate Now
- Inventory. Identify managed macOS endpoints using WatchGuard Endpoint Security Full Disk Encryption, exact Agent versions, FileVault key escrow and rotation state, local access, owners, and maintenance windows.
- Establish applicability. Match each managed Mac to the affected Agent range below 1.17.24.0000 and confirm Full Disk Encryption use. Do not infer exposure from macOS or WatchGuard presence alone.
- Remediate. Update WatchGuard Agent for macOS to 1.17.24.0000 or later through the supported management channel; follow approved FileVault recovery-key rotation procedures for exposed endpoints when the diagnostic log was present.
- Validate. Confirm the running Agent version, verify the diagnostic log no longer contains the recovery key, validate FileVault and escrow state, rotate keys when required by the exposure assessment, test recovery and management, and retain evidence without copying secrets into tickets.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The flaw requires local access by a user or process, but a recovery key can outlive the vulnerable Agent version. Do not place recovery keys in tickets, screenshots, or general logs; use approved secret-handling and key-rotation workflows.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
