CVE-2026-115253
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
An incorrect permission assignment in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.
Risk Assessment
An attacker can cover their tracks, destroy security logs, and prepare privilege escalation by placing malicious files in a privileged service's directory. This weakens incident detection and may lead to system compromise.
Recommendation
Update the WatchGuard Agent to a version containing the log directory permission fix. Also verify log directory permissions and monitor for unusual file changes.
Other vulnerabilities in WatchGuard Agent
See all- CVE-2026-57910Critical
Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.
- CVE-2026-57909Critical
A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system.
- CVE-2026-6788High
Uncontrolled search path element vulnerability in WatchGuard Agent on Windows allows using malicious files.
- CVE-2026-6787High
Use of hard-coded cryptographic key vulnerability in WatchGuard Agent on Windows allows inclusion of code in existing process.
- CVE-2026-41288High
Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate their privileges to NT AUTHORITY\SYSTEM.
- CVE-2026-41286Medium
Stack-based buffer overflow vulnerability in the WatchGuard Agent discovery service on Windows. An unauthenticated attacker on the same local network could exploit this to crash the agent service.
- CVE-2026-41287Medium
Stack-based buffer overflow vulnerability in the WatchGuard Agent discovery service on Windows. An unauthenticated attacker on the same local network could exploit this to crash the agent service.
Original NVD description (English source)
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS