WatchDog Antivirus CVE-2026-92254

Requires the WatchDog Antivirus product (v1.8.640) to be installed with the vulnerable wsdkd.sys kernel driver (version 1.3.0.0 or earlier) loaded and exposing the \Device\wsdk device object. The attacker must already have LOCAL, interactive or code-execution access as a low-privileged (non-admin) user on the host to open a handle and issue IOCTLs - there is no remote or unauthenticated vector. Limiting factors: exploitation is confined to hosts where this specific third-party AV is deployed; it is local-only (no network reach); and it grants file-deletion/destruction rather than direct code execution or data theft, so the primary payoff is disabling security tooling or denial of service rather than confidentiality loss.

This is a legitimate but moderate local privilege-escalation-class flaw, not a remote emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) is internally consistent with the description: exploitation is strictly LOCAL and requires an already-authenticated low-privileged foothold (PR:L), but yields high integrity and availability impact (arbitrary file deletion as SYSTEM) with no confidentiality gain (VC:N - you delete, you don't read). The vendor's 6.9 score is reasonable and I concur. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is targeted, hands-on-keyboard tradecraft rather than mass-exploitable. The realistic risk is that this becomes a post-compromise building block: an attacker or malware that already has a low-priv shell uses it to delete AV/EDR files, protected system files, or NTFS-ACL-protected objects to disable defenses or brick the host. Note the CWE is labeled CWE-20 (Improper Input Validation), but the described root cause is missing authorization on IOCTL handlers (closer to CWE-862/CWE-73 arbitrary file deletion) - verify the CWE mapping with the vendor. No conflicting AV signals: description and CVSS both agree this is local.

An attacker who has gained a standard low-privileged user session on a Windows host running WatchDog Antivirus opens a handle to the \Device\wsdk device and issues a crafted IOCTL to the wsdkd.sys driver, whose handler performs no authorization or path validation. The driver, running in kernel/SYSTEM context, deletes an attacker-specified file - bypassing NTFS ACLs - allowing deletion of EDR/AV components or critical OS files to disable protection or destabilize the system. No public POC is referenced in the provided data, so this would require original driver-IOCTL reverse engineering.