Vulnerability · Published Sep 20, 2026 · Assigned by watchdog
CVE-2026-92254WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL
Medium 6.9
In plain English
A medium-severity improper input validation in Anti-Virus from Watchdog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and potentially disabling security products or destabilizing the operating system, via crafted IOCTL requests sent to the \Device\wsdk device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Watchdog | Anti-Virus | 1.8.640 – before 1.8.804 |
Weakness: CWE-20, CWE-306 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/RE:L/U:Amber