CVE-2026-115253— WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering
Quick assessment
Affected
WatchGuard WatchGuard Agent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WatchGuard 代理程序的日志目录存在权限分配错误漏洞。该漏洞允许本地已认证的非管理员用户创建、修改、追加或删除代理程序的日志文件，并可在该目录中写入其他文件。攻击者可借此篡改或销毁代理程序的安全日志，并通过在由特权服务拥有的目录中放置可执行内容，为后续本地攻击创造条件。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115253
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering
Source: CVE Program / CVE List V5
Vulnerability Description
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
缺省权限不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WatchGuard | WatchGuard Agent | 0 ~ 1.25.14.0000 | - |
|
II. Public POCs for CVE-2026-115253
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115253
请登录查看更多情报信息。
Other References for CVE-2026-115253 (1)
-
https://psirt.watchguard.com/CVE-2026-115253 vendor-advisory
IV. Related Vulnerabilities
Same product: WatchGuard Agent
-
CVE-2026-96293
Endpoint Security Cleartext Storage of FileVault Recovery Ke -
CVE-2026-57910
WatchGuard Agent improper authentication allows unauthentica -
CVE-2026-57909
WatchGuard Agent path traversal allows unauthenticated remot -
CVE-2026-6788
Uncontrolled search path in PluginLauncher allows SYSTEM cod -
CVE-2026-6787
Usage of a hard-coded cryptographic key in WatchGuard Agent
Same vendor: WatchGuard
-
CVE-2026-96293
Endpoint Security Cleartext Storage of FileVault Recovery Ke -
CVE-2026-13043
WatchGuard Endpoint Security Missing Authentication in Kerne -
CVE-2026-86134
Fireware OS Pre-Authentication NULL Pointer Dereference Allo -
CVE-2026-90441
Fireware OS Missing Authorization in wgagent Management API -
CVE-2026-18145
Fireware OS Stack-based Buffer Overflow in spamd Allows Remo
Same weakness: CWE-276
-
CVE-2026-107571
Incorrect Default Permissions in hMailServer -
CVE-2026-85300
Apache Camel: Camel-PQC Private Key Disclosure via Key Mater -
CVE-2026-108072
Insecure Permissions on Shared Startup Scripts Allow Cross-U -
CVE-2026-110359
Hyland Desktop Host 本地提权漏洞 -
CVE-2026-105009
Windows Server Update Service Elevation of Privilege Vulnera
V. Comments for CVE-2026-115253
No comments yet