{"id":"CVE-2026-115253","kind":"vulnerability","aliases":["CVE-2026-115253"],"related":[],"title":"WatchGuard Agent: log directory permissions let local users tamper with logs","description":"An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.","summary":"The WatchGuard Agent creates its log directory with incorrect permissions, so any local authenticated non-admin user can create, modify or delete its log files and write other files there. An attacker can erase or alter the agent's security logs and plant executable content in a directory owned by a privileged service to escalate further.","severity":"high","cvss":7.3,"epss":0.00096,"exploited":false,"exploited_at":null,"products":[{"name":"WatchGuard Agent (Windows)","fixed":["1.25.14.0000"],"affected":">= 0, < 1.25.14.0000","ecosystem":"vendor"}],"ecosystems":[],"tags":["endpoint","local-privilege-escalation","other","watchguard","watchguard-agent","windows"],"not_affected_if":["agent-1.25.14.0000-or-later","macos","no-local-untrusted-users"],"how_to_check":"Check the installed WatchGuard Agent version on Windows endpoints (WatchGuard Cloud device inventory or installed programs); any version below 1.25.14.0000 is affected. The advisory gives no other check.","fix":"Update WatchGuard Agent for Windows to 1.25.14.0000 or later (released 2026-10-22).","status":"open","published_at":"2026-10-22T09:17:16+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:27:21+00:00","updated_at":"2026-10-25T03:27:59+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-25T03:27:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"WatchGuard Agent: log directory permissions let local users tamper with logs","impact":"medium","summary":"The WatchGuard Agent creates its log directory with incorrect permissions, so any local authenticated non-admin user can create, modify or delete its log files and write other files there. An attacker can erase or alter the agent's security logs and plant executable content in a directory owned by a privileged service to escalate further.","category":"other","nicknames":[],"who_cares":["watchguard","windows"],"confidence":0.6,"needs_auth":"yes","worst_case":"Security logs erased and executable files planted in a privileged service directory","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115253 for affected WatchGuard Agent versions and the vendor fixed release, and the WatchGuard advisory it cites.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000539,"input_tokens":3377,"output_tokens":402,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115253 for affected WatchGuard Agent versions and the vendor fixed release, and the WatchGuard advisory it cites.","search":"'-115253':14A,17A '-2026':13A,16A 'admin':48B 'administr':106C 'agent':2A,19A,30B,34B,70B,96C,116C,137C 'allow':100C,128C 'alter':68B 'append':111C 'assign':91C 'attack':64B,130C,145C 'authent':45B,103C 'content':77B,149C 'creat':35B,51B,109C 'cve':12A,15A 'delet':54B,114C 'destroy':135C 'directori':4A,38B,80B,99C,126C,152C 'endpoint':21B 'eras':66B 'escal':25B,87B 'execut':76B,148C 'file':57B,61B,119C,123C 'incorrect':40B,89C 'let':6A 'local':7A,23B,44B,102C,144C 'local-privilege-escal':22B 'log':3A,11A,37B,56B,73B,98C,118C,140C 'modifi':52B,110C 'non':47B,105C 'non-admin':46B 'non-administr':104C 'own':81B,153C 'permiss':5A,41B,90C 'place':147C 'plant':75B 'privileg':24B,84B,156C 'secur':72B,139C 'servic':85B,157C 'stage':142C 'tamper':9A,132C 'user':8A,49B,107C 'vulner':92C 'watchguard':1A,18A,27B,29B,33B,95C 'watchguard-ag':28B 'window':31B 'windows':20A 'write':59B,121C","nicknames":[],"mitigations":[],"who_affected":"Windows endpoints running WatchGuard Agent older than 1.25.14.0000. Exploitation needs a local, authenticated non-admin account, so shared machines, terminal servers and workstations with untrusted users matter most. macOS agents and machines with no untrusted local users can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:27:59Z","by":"analyst","run_id":721},"products":{"at":"2026-10-25T03:27:59Z","by":"analyst","run_id":721}},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115253","severity":null,"published_at":"2026-10-22T09:17:16+00:00","modified_at":"2026-10-23T04:18:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115253","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115253","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115253:721","url":null,"severity":null,"published_at":"2026-10-25T03:27:59+00:00","modified_at":"2026-10-25T03:27:59+00:00","first_seen_at":"2026-10-25T03:27:59+00:00","fetched_at":"2026-10-25T03:27:59+00:00","note":"WatchGuard PSIRT: Windows agent < 1.25.14.0000 affected, fixed in 1.25.14.0000 (release notes 22 Oct 2026 confirm; they mislabel the fix as CVE-2026-96293, a sibling macOS FileVault CVE, likely a typo). No exploitation or PoC found; no vendor mitigations."}],"documents":[{"id":3179,"url":"https://psirt.watchguard.com/CVE-2026-115253","title":"WatchGuard PSIRT CVE-2026-115253","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3180,"url":"https://www.watchguard.com/support/release-notes/cloud/Content/en-US/WatchGuard-Cloud/EN_wg-agent-releases.html","title":"WatchGuard Agent Releases (1.25.14.0000)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}