The WatchGuard Agent uses a log directory that is incorrectly permissioned, allowing a local authenticated non‑administrative user to create, modify, append, or delete log files and to write arbitrary files into that directory. This flaw is an instance of improper access control (CWE‑276) and incorrect permission assignment (CWE‑732). The ability to alter or delete logs can conceal future attacks and enables an adversary to place executable content in a directory owned by a privileged service, facilitating further local compromise.

The vulnerability affects the WatchGuard Agent product across all versions supported by WatchGuard. Specific affected release numbers are not listed in the advisory, so users should verify the version they are running against the vendor's published patch set for CVE‑2026‑115253.

The CVSS score of 7.3 indicates a high‑severity risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires local, authenticated access by a non‑admin user, making it a practical threat in environments where such users have substantial file write capabilities on the host. Once the log files are compromised, the attacker can hide subsequent malicious activity and potentially bypass privileged service controls by exploiting the writable log directory.