CVE-2026-115253: CWE-276 in WatchGuard WatchGuard Agent

This vulnerability involves improper permission assignment (CWE-276) in the WatchGuard Agent's log directory. Local authenticated users without administrative privileges can create, modify, append, or delete log files and write arbitrary files into this directory. Because the directory is owned by a privileged service, attackers can tamper with security logs and potentially stage further local attacks by placing executable content in the directory.

An attacker with local authenticated access but without administrative rights can manipulate security logs, undermining the integrity of audit trails. Additionally, the attacker can place executable files in a directory owned by a privileged service, potentially enabling privilege escalation or other local attacks. This compromises the security monitoring and can facilitate further exploitation on the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to the WatchGuard Agent's log directory and monitor for unauthorized file modifications. Avoid running the agent with excessive privileges where possible.