{"metadata": {"vulnerability": "CVE-2026-79417", "count": 23, "kinds": {"milestone": 4, "sighting": 11, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-08-25T00:00:00Z", "date_only": false, "value": "2026-08-25T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-79417", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-25T02:00:08Z", "date_only": false, "value": "2026-09-25T02:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103286", "record": "CVE-2026-79417", "field": "creation_timestamp", "uuid": "2eceeb02-fd9d-43aa-b533-450f989851ce", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-79417\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a connorjaydunn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 01:03:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-79417 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103286"}, {"timestamp": "2026-09-25T02:00:08Z", "date_only": false, "value": "2026-09-25T02:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103286", "record": "CVE-2026-79417", "field": "creation_timestamp", "uuid": "fb46b3a0-6fba-4a12-82d4-e9c031aef217", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-79417\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a connorjaydunn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 01:03:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-79417 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103286"}, {"timestamp": "2026-09-25T02:28:12.948Z", "date_only": false, "value": "2026-09-25T02:28:12.948466Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mwcpvuzguu2q", "record": "CVE-2026-79417", "field": "creation_timestamp", "uuid": "8ea6b1a5-4a92-4af5-b8e9-71a69a167095", "content": "Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)", "url": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mwcpvuzguu2q"}, {"timestamp": "2026-09-25T03:00:11Z", "date_only": false, "value": "2026-09-25T03:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/RACfXFf4CCpOLZKZyR5Qndk-K5ZPYrCccXnDxmxSnxIfo6Q", "record": "CVE-2026-79417", "field": "creation_timestamp", "uuid": "217e9bb3-5816-490b-8031-6fc212368e20"}, {"timestamp": "2026-09-25T03:00:11Z", "date_only": false, "value": "2026-09-25T03:00:11.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/RACfXFf4CCpOLZKZyR5Qndk-K5ZPYrCccXnDxmxSnxIfo6Q", "record": "CVE-2026-79417", "field": "creation_timestamp", "uuid": "aebcaa63-0e2d-4b28-9ffb-878f604c126b"}, {"timestamp": "2026-09-25T04:00:27Z", "date_only": false, "value": "2026-09-25T04:00:27.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/cef2c12046d7246fbad5e72900e0d2df", "record": "CVE-2026-79417", "field": "creation_timestamp", "uuid": "852e28f1-311c-441e-9f38-fa3a1df531d5", "content": "Today\u2019s threat intelligence digest highlights four notable vulnerabilities:\n\n\u2022 **macOS TCC Bypass:** CDC/ACM serial interfaces can circumvent macOS Transparency, Consent, and Control (TCC) security restrictions, granting unauthorized access to protected resources.  \n\u2022 **pfSense LFI (CVE-2026-97730, HIGH/8.5):** A flaw in dashboard widget sequence handling allows local file inclusion, enabling arbitrary PHP execution (requires authentication and dashboard modification privileges).  \n\u2022 **Argus Monitor DoS (CVE-2026-79417):** A local IOCTL vulnerability exploits a TOCTOU race condition to disable x86 `MONITOR`/`MWAIT` instructions, triggering `HYPERVISOR_ERROR` bugchecks in Hyper-V and kernel components.  \n\u2022 **Root Browser Classic Injection (CVE-2026-85082, HIGH/8.5):** Unsafe passing of SQLite database paths to the OS shell enables command injection due to improper filename/command separation.  \n\nAll entries include technical write-ups, CVSS metrics, and proof-of-concept resources for further analysis.", "url": "https://gist.github.com/ichintu/cef2c12046d7246fbad5e72900e0d2df"}, {"timestamp": "2026-09-25T09:00:04Z", "date_only": false, "value": "2026-09-25T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Yeumbd0afhQFKWhtQ_kYIVtV861DL6U2SRa0YhPEpV3GAh8", "record": "CVE-2026-79417", "field": "creation_timestamp", "uuid": "a800dc56-e4ef-4c1a-bc1e-fd61e5bdd1b6"}, {"timestamp": "2026-09-25T09:00:04Z", "date_only": false, "value": "2026-09-25T09:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/Yeumbd0afhQFKWhtQ_kYIVtV861DL6U2SRa0YhPEpV3GAh8", "record": "CVE-2026-79417", "field": "creation_timestamp", "uuid": "3ac171a3-f678-4bae-b940-af7c6e6bf15d"}, {"timestamp": "2026-09-26T15:39:32.005Z", "date_only": false, "value": "2026-09-26T15:39:32.005166Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mwgmlt6s4m24", "record": "CVE-2026-79417", "field": "creation_timestamp", "uuid": "0ca12f58-5f8c-4042-865d-1cad8c500673", "content": "Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)", "url": "https://bsky.app/profile/r-netsec.bsky.social/post/3mwgmlt6s4m24"}, {"timestamp": "2026-09-29T00:00:00Z", "date_only": false, "value": "2026-09-29T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-79417", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-29T19:36:00.279Z", "date_only": false, "value": "2026-09-29T19:36:00.279Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2026-79417", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-29T20:17:26Z", "date_only": false, "value": "2026-09-29T20:17:26Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-Q22R-QWFG-76WV", "record": "GHSA-Q22R-QWFG-76WV", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-29T20:17:26.870Z", "date_only": false, "value": "2026-09-29T20:17:26.870", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-79417", "record": "FKIE_CVE-2026-79417", "field": "published"}, {"timestamp": "2026-09-29T21:33:26Z", "date_only": false, "value": "2026-09-29T21:33:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-Q22R-QWFG-76WV", "record": "GHSA-Q22R-QWFG-76WV", "field": "published"}, {"timestamp": "2026-09-30T19:03:25.244Z", "date_only": false, "value": "2026-09-30T19:03:25.244669Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-79417", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-09-30T19:03:25.244Z", "date_only": false, "value": "2026-09-30T19:03:25.244669Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-79417", "record": "FKIE_CVE-2026-79417", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-30T20:11:10.584Z", "date_only": false, "value": "2026-09-30T20:11:10.584Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-79417", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-30T20:11:10.584Z", "date_only": false, "value": "2026-09-30T20:11:10.584Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-79417", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-30T21:17:15.657Z", "date_only": false, "value": "2026-09-30T21:17:15.657", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-79417", "record": "FKIE_CVE-2026-79417", "field": "lastModified"}, {"timestamp": "2026-09-30T21:32:03Z", "date_only": false, "value": "2026-09-30T21:32:03Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-Q22R-QWFG-76WV", "record": "GHSA-Q22R-QWFG-76WV", "field": "modified"}, {"timestamp": "2026-10-03T03:57:15Z", "date_only": false, "value": "2026-10-03T03:57:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/196473", "record": "CVE-2026-79417", "field": "creation_timestamp", "uuid": "6d919523-ab25-4dee-9bc5-c1f2efa2ec2e", "content": "Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)\nhttps://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/\n\n(1) An exposed IOCTL lets unprivileged users disable the x86 MONITOR (https://www.felixcloutier.com/x86/monitor) & MWAIT (https://www.felixcloutier.com/x86/mwait) instructions used by Hyper-V (https://en.wikipedia.org/wiki/Hyper-V) and other kernel components--triggering a HYPERVISOR_ERROR bugcheck. (2) Reaching the IOCTL requires exploiting a TOCTOU (https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use) bug arguably caused by poor documentation of the SeLocateProcessImageName (https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-selocateprocessimagename) function. (3) Reimplementation of the driver's security through obscurity IOCTL encryption scheme: SHA-256 KDF-derived XOR keystream & CRC16 Checksum. See full write-up (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/), and Github (https://github.com/connorjaydunn/CVE-2026-79417) for PoC.    submitted by    /u/p0xq  (https://www.reddit.com/user/p0xq) \n [link] (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/)   [comments] (https://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/)", "url": "https://t.me/hacking_Attack/196473"}, {"timestamp": "2026-10-03T03:57:15Z", "date_only": false, "value": "2026-10-03T03:57:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/196473", "record": "CVE-2026-79417", "field": "creation_timestamp", "uuid": "2dc2025e-f39c-4f09-96e4-6cb6107290ff", "content": "Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)\nhttps://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/\n\n(1) An exposed IOCTL lets unprivileged users disable the x86 MONITOR (https://www.felixcloutier.com/x86/monitor) & MWAIT (https://www.felixcloutier.com/x86/mwait) instructions used by Hyper-V (https://en.wikipedia.org/wiki/Hyper-V) and other kernel components--triggering a HYPERVISOR_ERROR bugcheck. (2) Reaching the IOCTL requires exploiting a TOCTOU (https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use) bug arguably caused by poor documentation of the SeLocateProcessImageName (https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-selocateprocessimagename) function. (3) Reimplementation of the driver's security through obscurity IOCTL encryption scheme: SHA-256 KDF-derived XOR keystream & CRC16 Checksum. See full write-up (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/), and Github (https://github.com/connorjaydunn/CVE-2026-79417) for PoC.    submitted by    /u/p0xq  (https://www.reddit.com/user/p0xq) \n [link] (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/)   [comments] (https://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/)", "url": "https://t.me/hacking_Attack/196473"}]}