Live › vulnerability › CVE-2026-115253
Go to dashboardThe WatchGuard Agent creates its log directory with incorrect permissions, so any local authenticated non-admin user can create, modify or delete its log files and write other files there. An attacker can erase or alter the agent's security logs and plant executable content in a directory owned by a privileged service to escalate further.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Windows endpoints running WatchGuard Agent older than 1.25.14.0000. Exploitation needs a local, authenticated non-admin account, so shared machines, terminal servers and workstations with untrusted users matter most. macOS agents and machines with no untrusted local users can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WatchGuard Agent (Windows) | vendor | >= 0, < 1.25.14.0000 | 1.25.14.0000 |
1.25.14.0000 is affectedUpdate WatchGuard Agent for Windows to 1.25.14.0000 or later (released 2026-10-22).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.
This page as .md · .json · in your agent: get_signal("CVE-2026-115253")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.