CVE-2026-92254

Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and potentially disabling security products or destabilizing the operating system, via crafted IOCTL requests sent to the \Device\wsdk device.

CVSS

No CVSS.

References

Link	Resource
https://watchdog.com/anti-virus-release-notes/
https://watchdog.com/vulnerability-disclosure-policy/

Configurations

No configuration.

History

20 Sep 2026, 13:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-20 13:17

Updated : 2026-09-22 19:41

NVD link : CVE-2026-92254

Mitre link : CVE-2026-92254

CVE.ORG link : CVE-2026-92254

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-92254", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92254", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-21T14:16:20.582346Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "34edf4f2-2577-40ab-82ce-39f45972c129", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "YES", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "34edf4f2-2577-40ab-82ce-39f45972c129", "affectedData": [{"vendor": "Watchdog", "product": "Anti-Virus", "versions": [{"status": "affected", "version": "1.8.640", "lessThan": "1.8.804", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-09-20T13:17:46.390", "references": [{"url": "https://watchdog.com/anti-virus-release-notes/", "source": "34edf4f2-2577-40ab-82ce-39f45972c129"}, {"url": "https://watchdog.com/vulnerability-disclosure-policy/", "source": "34edf4f2-2577-40ab-82ce-39f45972c129"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "34edf4f2-2577-40ab-82ce-39f45972c129", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Missing Authorization in the IOCTL handlers of the\u00a0wsdkd.sys\u00a0kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and potentially disabling security products or destabilizing the operating system, via crafted IOCTL requests sent to the \\Device\\wsdk device."}], "lastModified": "2026-09-22T19:41:38.447", "sourceIdentifier": "34edf4f2-2577-40ab-82ce-39f45972c129"}