WatchDog Anti-Virus EUVD-2026-83740

Requires an interactive or otherwise-present local, low-privileged user account on a Windows host where WatchDog Anti-Virus was installed with its default (vulnerable) installer, which grants the Users group Full Control over C:\Program Files (x86)\Watchdog Anti-Virus. Full privileged code execution additionally requires that an elevated WatchDog process actually load one of the attacker-modified binaries (a service restart, scheduled scan, or update trigger); merely disabling protection needs only delete/modify rights, which the misconfiguration already grants. Limiting factors: no remote/network vector (AV:L), attacker must already have PR:L local access, and exploitation is confined to systems still on the affected installer build.

This is a genuine but locally-scoped risk. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms exploitation requires local access with at least low-level authenticated privileges - this is a privilege-escalation/AV-tampering primitive, not a remote attack. Impact is high across all three vulnerable-system metrics (VC:H/VI:H/VA:H) because a low-privileged user can neutralize the antivirus (availability), tamper with its binaries/config (integrity), and potentially gain SYSTEM-level code execution when an elevated WatchDog process loads a planted binary (confidentiality). The vendor threat metrics temper this: E:U indicates exploit code is unproven/not public, so there is no POC or KEV listing and no active-exploitation signal - no public exploit identified at time of analysis. Notably AU:Y (Automatable) is set, meaning that once a foothold exists the misconfiguration is trivially and reliably abusable. Net: real priority on any host where untrusted local users run, but the local-only vector and absence of exploitation evidence keep it below internet-facing critical issues. No EPSS score, KEV entry, or POC was provided, and references are only vendor policy/release-notes pages with no confirmed fixed version - so remediation tracking must be verified directly with WatchDog.

A low-privileged user on a Windows workstation running WatchDog Anti-Virus, leveraging the Users-group Full Control ACL on C:\Program Files (x86)\Watchdog Anti-Virus, replaces a WatchDog executable or DLL with a malicious one. When the elevated WatchDog service or scheduled component next loads that binary, the attacker's code runs with elevated privileges; alternatively the user simply deletes/corrupts binaries to disable protection. No public exploit code is identified at time of analysis (CVSS E:U), but the flaw is marked automatable once local access is obtained.