VULNERABILITY INTELLIGENCE

CVE-2025-15561

CVSS score7.8 HIGH
EPSS probability0.12%
CISA KEVNot currently listed
Published2026-02-19
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious executable must be named  WTWatch.exe and dropped in the C:\ProgramData\wta\ClientExe directory, which is writable by "Everyone". The executable will then be run by the WorkTime monitoring daemon.

Weakness classification

  • 551230f0-3615-47bd-b7cc-93e92e730bbf: CWE-269
  • nvd@nist.gov: NVD-CWE-noinfo

Primary references