High severity · published Oct 22, 2026
CVE-2026-115253
WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering
New
7.3
CVSS
0.1%
EPSS
No
On KEV
Description
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WatchGuard Agent · WatchGuard
before 1.25.14.0000 · source: vendor
Affected product
WA
WatchGuard Agent
WatchGuard
More from WatchGuard Agent
9.4
CVE-2026-57909
WatchGuard Agent path traversal allows unauthenticated remote code execution
9.3
CVE-2026-57910
WatchGuard Agent improper authentication allows unauthenticated remote code execution
7.8
CVE-2026-6788
Uncontrolled search path in PluginLauncher allows SYSTEM code execution in WatchGuard Agent
7.8
CVE-2026-6787
Usage of a hard-coded cryptographic key in WatchGuard Agent allows inclusion of code into existing process
7.8
CVE-2026-41288
WatchGuard Agent on Windows Privilege Escalation Vulnerability