WatchGuard Agent CVE-2026-115253

Requires a local, authenticated non-administrative account (PR:L) on a host where the WatchGuard Agent is installed, plus the specific misconfiguration: the agent's log directory carries incorrect permissions that let a non-privileged user create, modify, append to, or delete files within it. What limits exploitation: there is no remote or network path (AV:L) and no unauthenticated access - the attacker must already have an interactive local user account; the AT:P metric indicates an additional attack requirement outside the attacker's full control. The log-tampering impact is immediate, but the privilege-escalation outcome is only a staging primitive (placing executable content in a privileged-service-owned directory) and depends on a further, undescribed mechanism to execute that content.

This is a locally-exploitable permission-misconfiguration flaw (CWE-276), not a remote critical. The vendor's CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) confirms the attacker must already be a local, authenticated non-administrative user on a host running the WatchGuard Agent - there is no network vector and no path to exploitation without an existing foothold. vuln.today assigns a 'this_week' priority, consistent with a meaningful-but-not-emergency local flaw. Exploitation signals are modest: no CISA KEV listing and no public exploit identified at time of analysis (the only reference is the WatchGuard PSIRT advisory, not a PoC), so there is no evidence of active or automatable exploitation. The 7.3 base score is driven by the vendor rating VC/VI/VA all High, but the description substantiates mainly integrity and availability impact on the agent's security logs plus a staging primitive for further local attacks; a direct confidentiality breach is not described, so the High confidentiality rating is not clearly supported by the text - verify impact scope with WatchGuard. Net: a real defensive hygiene priority on hosts where untrusted local users have accounts, but a low-urgency item on single-user or tightly-controlled endpoints. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be compared here.

A local user with a standard (non-administrative) account on a machine running the WatchGuard Agent writes to the agent's weakly-permissioned log directory, deleting or altering security log files to cover tracks after other malicious activity. Because the directory is owned by a privileged service, the same user drops executable content there to set up a subsequent local privilege-escalation attempt. No public exploit code was identified; exploitation requires an existing authenticated local foothold.