CVE-2025-15561: Nestersoft Worktime

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious executable must be named  WTWatch.exe and dropped in the C:\ProgramData\wta\ClientExe directory, which is writable by "Everyone". The executable will then be run by the WorkTime monitoring daemon.

Affected products

• Nestersoft Worktime: up to and including 11.8.8

Published 2026-02-19. Last modified 2026-06-17.