Read the docs
TI-2026-62281 Aliases CVE-2026-92254GHSA-g5cw-xv36-rr58

WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL

Priority LOW 29CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and potentially disabling security products or destabilizing the operating system, via crafted IOCTL requests sent to the \Device\wsdk device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00141 3rd percentileScored 2026-11-07
Fix Fixed Anti-Virus (Watchdog): 1.8.804

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WatchdogAnti-Virus1.8.640 to before 1.8.8041.8.804Patch availableCNA
  • Anti-Virus VendorWatchdog Affected 1.8.640 to before 1.8.804 Fixed in 1.8.804 Patch available CNA

Remediation

  • Fix · CNA Anti-Virus (Watchdog) Fixed in 1.8.804

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WatchDog Anti-Virus 1.8.804

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-62279 Incorrect Default Permissions in WatchDog Anti-Virus Installation DirectoryPriority LOW 27
    • TI-2026-62280 Arbitrary File Write via Directory Junction in WatchDog Anti-Virus Quarantine RestorationPriority LOW 23
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-92254
  2. 2026-10-03 Alias added: GHSA-g5cw-xv36-rr58

References

Other 2

  • TI-2022-18155 Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus… CVSS 3.1MEDIUM 6.5
  • TI-2022-18165 Incorrect access control in Watchdog Anti-Virus v1.4.158 allows attackers to perform a… CVSS 3.1HIGH 7.8
  • TI-2022-20360 Certain Zemana products are vulnerable to Arbitrary code injection. CVSS 3.1MEDIUM 6.7
  • TI-2023-01372 Watchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 access control CVSS 3.1HIGH 7.1
  • TI-2026-62279 Incorrect Default Permissions in WatchDog Anti-Virus Installation Directory CVSS 4.0MEDIUM 5.9
  • TI-2023-01365 Watchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 denial of service CVSS 3.1MEDIUM 5.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences