---
id: "CVE-2026-115253"
kind: "vulnerability"
aliases: ["CVE-2026-115253"]
title: "WatchGuard Agent: log directory permissions let local users tamper with logs"
severity: "high"
cvss: 7.3
epss: 0.00096
exploited: false
status: "open"
category: "other"
products: [{"name": "WatchGuard Agent (Windows)", "fixed": ["1.25.14.0000"], "affected": ">= 0, < 1.25.14.0000", "ecosystem": "vendor"}]
ecosystems: []
tags: ["endpoint", "local-privilege-escalation", "other", "watchguard", "watchguard-agent", "windows"]
not_affected_if: ["agent-1.25.14.0000-or-later", "macos", "no-local-untrusted-users"]
published_at: "2026-10-22T09:17:16+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:27:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115253", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115253", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:27:59+00:00"}]
---

# WatchGuard Agent: log directory permissions let local users tamper with logs

The WatchGuard Agent creates its log directory with incorrect permissions, so any local authenticated non-admin user can create, modify or delete its log files and write other files there. An attacker can erase or alter the agent's security logs and plant executable content in a directory owned by a privileged service to escalate further.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WatchGuard Agent (Windows) affected >= 0, < 1.25.14.0000 fixed 1.25.14.0000

## How to check

Check the installed WatchGuard Agent version on Windows endpoints (WatchGuard Cloud device inventory or installed programs); any version below 1.25.14.0000 is affected. The advisory gives no other check.

## Fix

Update WatchGuard Agent for Windows to 1.25.14.0000 or later (released 2026-10-22).

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115253
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115253
- 2026-10-25T03:27:59+00:00 analyst — WatchGuard PSIRT: Windows agent < 1.25.14.0000 affected, fixed in 1.25.14.0000 (release notes 22 Oct 2026 confirm; they mislabel the fix as CVE-2026-96293, a sibling macOS FileVault CVE, likely a typo). No exploitation or PoC found; no vendor mitigations.

## Documents

- [advisory] WatchGuard PSIRT CVE-2026-115253 https://psirt.watchguard.com/CVE-2026-115253
- [fix] WatchGuard Agent Releases (1.25.14.0000) https://www.watchguard.com/support/release-notes/cloud/Content/en-US/WatchGuard-Cloud/EN_wg-agent-releases.html

## From the sources

An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_