CVE-2026-92254

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92254", "assignerOrgId": "34edf4f2-2577-40ab-82ce-39f45972c129", "state": "PUBLISHED", "assignerShortName": "watchdog", "dateReserved": "2026-09-15T21:07:00.693Z", "datePublished": "2026-09-20T12:02:34.251Z", "dateUpdated": "2026-09-21T14:16:29.727Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "34edf4f2-2577-40ab-82ce-39f45972c129", "shortName": "watchdog", "dateUpdated": "2026-09-20T12:17:30.610Z"}, "title": "WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL", "datePublic": "2026-09-20T11:39:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper input validation", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-212", "descriptions": [{"lang": "en", "value": "CAPEC-212 Functionality Misuse"}]}], "affected": [{"vendor": "Watchdog", "product": "Anti-Virus", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "1.8.640", "lessThan": "1.8.804", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Missing Authorization in the IOCTL handlers of the\u00a0wsdkd.sys\u00a0kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and potentially disabling security products or destabilizing the operating system, via crafted IOCTL requests sent to the \\Device\\wsdk device.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing Authorization in the IOCTL handlers of the&nbsp;<span>wsdkd.sys</span><span>&nbsp;kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and potentially disabling security products or destabilizing the operating system, via crafted IOCTL requests sent to the \\Device\\wsdk device.</span><br>"}]}], "references": [{"url": "https://watchdog.com/vulnerability-disclosure-policy/"}, {"url": "https://watchdog.com/anti-virus-release-notes/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/RE:L/U:Amber"}}], "credits": [{"lang": "en", "value": "Patrick Tung", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-21T14:16:20.582346Z", "id": "CVE-2026-92254", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T14:16:29.727Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Patrick Tung"}], "impacts": [{"capecId": "CAPEC-212", "descriptions": [{"lang": "en", "value": "CAPEC-212 Functionality Misuse"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "YES", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/RE:L/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Watchdog", "product": "Anti-Virus", "versions": [{"status": "affected", "version": "1.8.640", "lessThan": "1.8.804", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "datePublic": "2026-09-20T11:39:00.000Z", "references": [{"url": "https://watchdog.com/vulnerability-disclosure-policy/"}, {"url": "https://watchdog.com/anti-virus-release-notes/"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Missing Authorization in the IOCTL handlers of the\u00a0wsdkd.sys\u00a0kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and potentially disabling security products or destabilizing the operating system, via crafted IOCTL requests sent to the \\Device\\wsdk device.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization in the IOCTL handlers of the&nbsp;<span>wsdkd.sys</span><span>&nbsp;kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and potentially disabling security products or destabilizing the operating system, via crafted IOCTL requests sent to the \\Device\\wsdk device.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper input validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function"}]}], "providerMetadata": {"orgId": "34edf4f2-2577-40ab-82ce-39f45972c129", "shortName": "watchdog", "dateUpdated": "2026-09-20T12:17:30.610Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92254", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-21T14:16:20.582346Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-09-21T14:16:25.407Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-92254", "state": "PUBLISHED", "dateUpdated": "2026-09-20T12:17:30.610Z", "dateReserved": "2026-09-15T21:07:00.693Z", "assignerOrgId": "34edf4f2-2577-40ab-82ce-39f45972c129", "datePublished": "2026-09-20T12:02:34.251Z", "assignerShortName": "watchdog"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Anti-Virus", "vendor": "Watchdog", "versions": [{"lessThan": "1.8.804", "status": "affected", "version": "1.8.640", "versionType": "semver"}]}], "source": "34edf4f2-2577-40ab-82ce-39f45972c129"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization in the IOCTL handlers of the\u00a0wsdkd.sys\u00a0kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and potentially disabling security products or destabilizing the operating system, via crafted IOCTL requests sent to the \\Device\\wsdk device."}], "id": "CVE-2026-92254", "lastModified": "2026-09-22T19:41:38.447", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "source": "34edf4f2-2577-40ab-82ce-39f45972c129", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92254", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-21T14:16:20.582346Z", "version": "2.0.3"}}]}, "published": "2026-09-20T13:17:46.390", "references": [{"source": "34edf4f2-2577-40ab-82ce-39f45972c129", "url": "https://watchdog.com/anti-virus-release-notes/"}, {"source": "34edf4f2-2577-40ab-82ce-39f45972c129", "url": "https://watchdog.com/vulnerability-disclosure-policy/"}], "sourceIdentifier": "34edf4f2-2577-40ab-82ce-39f45972c129", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-306"}], "source": "34edf4f2-2577-40ab-82ce-39f45972c129", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[1.8.640,1.8.804)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Anti-Virus", "source": "cna", "vendor": "Watchdog"}, "product": "anti-virus", "vendor": "watchdog"}], "created": "2026-09-20T13:30:17.583374+00:00", "updated": "2026-09-20T13:45:07.025714+00:00", "vendors": ["watchdog", "watchdog$PRODUCT$anti-virus"]}