CVE-2026-115253: WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering
An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory. This allows an attacker to tamper with or destroy the agent's security logs and stage further local attacks by placing executable content in a directory owned by a privileged service.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs local, authenticated access as a non-administrative user. Remote access or administrative privileges are not identified as prerequisites.
What should be prioritized when assessing exposure?
Prioritize systems running the WatchGuard Agent where non-administrative users can log on locally or otherwise execute code under authenticated user accounts. Those users may be able to alter or remove security logs and place files in the agent log directory.