WatchDog Anti-Virus CVE-2026-92253

Requires local access as a low-privileged user on a Windows host running WatchDog Anti-Virus 1.8.640, with the ability to create a directory (NTFS) junction at the original path of a quarantined file. Exploitation is gated on an administrator being persuaded to invoke the quarantine restoration feature (UI:A / social engineering) - the attacker cannot trigger the privileged write alone. Realistic impact (SYSTEM code execution) further depends on choosing a target path suitable for DLL hijacking. Limiting factors: local-only vector, dependence on admin action, and the specific quarantine-restore workflow being used.

This is a genuine but conditional local privilege-escalation issue, not a high-urgency remote threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:A) correctly reflects local access, low existing privilege, and - critically - required Active user interaction (UI:A): an administrator must be persuaded to perform a quarantine restore. The vendor base score of 5.2 (medium) is consistent with this, though the vendor's impact metrics (VC:L/VI:L/VA:H) understate the described worst case: the write primitive can lead to SYSTEM-level code execution via DLL hijacking, which is high confidentiality/integrity/availability in practice. No EPSS score, no CISA KEV listing, and no POC were provided; per precision rules this is 'no public exploit identified at time of analysis.' The signals do not conflict, but the realistic exploitability is meaningfully limited by the social-engineering requirement (tricking an admin into restoring a specific file) plus the need to pre-place a directory junction. Net: real but low-to-medium priority, gated by non-trivial preconditions rather than a wormable/automatable flaw. Note the CVSS 4.0 vector says AT:N yet the described attack requires an out-of-attacker-control admin action - an arguable understatement of attack requirements worth verifying with the vendor.

A low-privileged local user places a malicious file into WatchDog's quarantine, then replaces the original file path with a directory junction pointing to a protected location (e.g., a directory from which a SYSTEM service loads DLLs). The attacker then convinces an administrator to restore the quarantined file, causing the AV - running with high privilege - to follow the junction and write the attacker-controlled file to the arbitrary target, enabling DLL hijacking and SYSTEM code execution. No public exploit code is identified at time of analysis.