# CVE-2026-115253: WatchGuard Agent incorrect permission assignment in log directory

Source: https://junglewise.ai/threats/cve-2026-115253-an-incorrect-permission-assignment-vulnerability-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-115253 · Severity: info · Published 2026-10-22

WatchGuard Agent is endpoint protection software that runs on Windows systems. An incorrect permissions vulnerability allows authenticated non-administrative users to tamper with the agent's security logs, potentially destroying evidence of attacks, and to place executable files in a privileged directory to escalate privileges or stage further attacks.

Technologies: [Watchguard Agent (Windows)](https://junglewise.ai/threats/technologies/agent). Vendors: [Watchguard](https://junglewise.ai/threats/vendors/watchguard).

## Quick answers

**Is CVE-2026-115253 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115253 being exploited in the wild.

**How severe is CVE-2026-115253?** Informational severity, published 22 October 2026.

**Which products and versions are affected?** Watchguard Agent (Windows) before 1.25.14.0000.

**Is there a fix for CVE-2026-115253?** Yes: fixed in WatchGuard Agent Windows 1.25.14.0000 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115253 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-115253?** Check whether you run Watchguard Agent (Windows) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in WatchGuard Agent Windows 1.25.14.0000 and later

## Technical details

The WatchGuard Agent's log directory is configured with overly permissive permissions (CWE-732, CWE-276), allowing local authenticated non-administrative users to create, modify, delete, and append to log files. An attacker can leverage this to destroy audit logs and place executable files in a directory owned by a privileged service to achieve privilege escalation or lateral movement.

## Affected products

- WatchGuard Agent Windows before 1.25.14.0000

## Timeline

- 2026-10-22: disclosed

## References

- [https://psirt.watchguard.com/CVE-2026-115253](https://psirt.watchguard.com/CVE-2026-115253)

## Related threats

- [WatchGuard Agent hard-coded cryptographic key in Windows agent](https://junglewise.ai/threats/cve-2026-6787-watchguard-agent-hard-coded-cryptographic-key-in-windows-agent)