CVE-2026-92254: WatchDog Antivirus Privilege Escalation Flaw

CVE-2026-92254 Overview

CVE-2026-92254 is a missing authorization vulnerability in the IOCTL handlers of the wsdkd.sys kernel driver shipped with Watchdog WatchDog Antivirus 1.8.640 and earlier driver versions up to 1.3.0.0. The driver exposes the \Device\wsdk device object without validating the privilege of the calling process. Local, low-privileged attackers can send crafted I/O control (IOCTL) requests to delete arbitrary files with SYSTEM privileges. The flaw bypasses NTFS access controls and can be used to disable security products or destabilize Windows. The weakness is categorized as [CWE-20] Improper Input Validation.

Critical Impact
Any authenticated local user can delete protected system or security-product files by issuing IOCTLs to a kernel driver that fails to check caller authorization.

Affected Products

Watchdog WatchDog Antivirus 1.8.640
Watchdog wsdkd.sys kernel driver versions 1.3.0.0 and earlier
Microsoft Windows hosts running the affected driver

Discovery Timeline

2026-09-20 - CVE-2026-92254 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-92254

Vulnerability Analysis

The wsdkd.sys driver registers a device object at \Device\wsdk and services user-mode requests through IOCTL handlers. These handlers accept file paths from callers and execute file operations in kernel context under the SYSTEM security token. Because the driver does not verify that the caller holds the privileges required to perform those operations, any process capable of opening the device handle can trigger arbitrary file deletion. The deletion occurs with kernel-level authority, so standard NTFS discretionary access control lists (DACLs) do not block the operation. Attackers commonly use such primitives to remove files belonging to endpoint protection products, drivers, or Windows components required for boot.

Root Cause

The IOCTL dispatch routine in wsdkd.sys lacks an access check on the requestor's token before performing privileged file operations. There is no validation that the caller has SeRestorePrivilege, SeTakeOwnershipPrivilege, or administrative group membership. The driver also does not restrict the security descriptor on the \Device\wsdk device object to administrators, allowing standard users to open a handle and issue control codes.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. The attacker opens a handle to \Device\wsdk using CreateFile, then invokes DeviceIoControl with a control code recognized by the vulnerable dispatcher and a buffer containing the target file path. The driver performs the deletion on behalf of the caller. Chaining this primitive with a known DLL hijacking or service-restart technique typically yields SYSTEM code execution. See the Watchdog Vulnerability Disclosure Policy for coordinated disclosure details.

Detection Methods for CVE-2026-92254

Indicators of Compromise

Unexpected user-mode processes opening handles to \Device\wsdk outside of the Watchdog product binaries.
Deletion of files under C:\Windows\System32, security-product install directories, or driver stores by processes running as a standard user.
Presence of wsdkd.sys with a file version at or below 1.3.0.0 on production endpoints.

Detection Strategies

Hunt for DeviceIoControl calls targeting \Device\wsdk from processes not signed by Watchdog.
Correlate Sysmon Event ID 23 (FileDelete) and Event ID 26 (FileDeleteDetected) against low-integrity parent processes acting on SYSTEM-owned paths.
Alert on driver load events (Event ID 6) for wsdkd.sys versions 1.3.0.0 or earlier following patch deployment windows.

Monitoring Recommendations

Enable kernel object access auditing on \Device\wsdk to record handle opens by non-Watchdog processes.
Baseline expected file deletions in protected directories and alert on deviations executed under user contexts.
Track EDR tamper events, service stops, and unexpected removal of security agent binaries as a chained-impact signal.

How to Mitigate CVE-2026-92254

Immediate Actions Required

Inventory endpoints for Watchdog WatchDog Antivirus 1.8.640 and enumerate the deployed wsdkd.sys version.
Upgrade the driver to a version later than 1.3.0.0 as published in the Watchdog Anti-Virus Release Notes.
Restrict interactive and remote-desktop access on hosts that cannot be patched immediately.

Patch Information

Watchdog has issued fixed builds of wsdkd.sys beyond version 1.3.0.0. Refer to the Watchdog Anti-Virus Release Notes for the exact remediated version and deployment guidance. Verify the driver file version after installation using sigcheck or Get-FileHash and confirm the vendor signature.

Workarounds

Block loading of vulnerable wsdkd.sys versions using Windows Defender Application Control (WDAC) or a driver blocklist policy.
Remove or disable the Watchdog product on affected hosts until the patched driver is available.
Restrict local logon rights so that only trusted administrators can execute code on hosts running the vulnerable driver.

bash

# Query the installed wsdkd.sys version on a Windows host
powershell -Command "(Get-Item 'C:\Windows\System32\drivers\wsdkd.sys').VersionInfo.FileVersion"

# Enumerate loaded kernel drivers and filter for wsdkd
powershell -Command "driverquery /v | Select-String 'wsdkd'"