https://vulnerability.circl.lu/sightings/feed 2026-10-09T18:33:37.158829+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/47b6ff32-2157-44e1-9cbd-52c0d7ec5d2e/export 2026-10-09T18:33:37.181388+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "47b6ff32-2157-44e1-9cbd-52c0d7ec5d2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29923", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/363", "content": "CVE-2026-29923\n\nThe pstrip64.sys driver in EnTech Taiwan PowerStrip <=3.90.736 allows local users to escalate privileges to SYSTEM via a crafted IOCTL request enabling unprivileged users to map arbitrary physical memory into their address space and modify critical kernel structures.\n\nGitHub Link:\nhttps://github.com/athenasec16/CVE-2026-29923", "creation_timestamp": "2026-08-28T00:00:30.625851Z"} 2026-08-28T00:00:30.625851+00:00 https://vulnerability.circl.lu/sighting/6742b2a1-e391-4bea-b77a-abf614abd226/export 2026-10-09T18:33:37.183863+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6742b2a1-e391-4bea-b77a-abf614abd226", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29923", "type": "exploited", "source": "https://t.me/CyberSecurityExploit/17200", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udea8 Windows Zero-Day & Related CVEs (PoC Included)\n\n\ud83e\udde8 1. BlueHammer (CVE-2026-33825)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Impact: User \u2192 SYSTEM privileges\n\u2022 Features:\n \u2022 Exploits Windows Defender update mechanism\n \u2022 TOCTOU + Path Confusion\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Used in real-world attacks\n \u2022 Patched\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/BlueHammer\n\n\ud83d\udd25 2. RedSun (Windows Defender Zero-Day)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Impact: SYSTEM privileges\n\u2022 Features:\n \u2022 Reparse Point + file overwrite\n \u2022 Abuses Defender logic\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Actively exploited\n \u2022 Unpatched in some environments\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/RedSun\n\n\u2620\ufe0f 3. UnDefend\n\u2022 Type: Defender Disable / DoS\n\u2022 Impact:\n \u2022 Blocks Defender updates\n \u2022 Disables security protections\n\u2022 Features:\n \u2022 Works with standard user privileges\n \u2022 Critical in attack chains\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Partially unpatched\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/UnDefend\n\n\ud83d\udca5 4. CVE-2026-20841 (Windows Notepad RCE)\n\u2022 Type: Remote Code Execution (RCE)\n\u2022 Condition:\n \u2022 Opening a malicious Markdown file\n\u2022 Features:\n \u2022 Improper input validation\n \u2022 Multiple PoCs available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/404godd/CVE-2026-20841-PoC\nhttps://github.com/dogukankurnaz/CVE-2026-20841-PoC\nhttps://github.com/hackfaiz/CVE-2026-20841-PoC\nhttps://github.com/tangent65536/CVE-2026-20841\nhttps://github.com/SecureWithUmer/CVE-2026-20841\nhttps://github.com/EleniChristopoulou/PoC-CVE-2026-20841\n\n\ud83d\udd0d 5. CVE-2026-20805 (DWM Info Leak)\n\u2022 Type: Information Disclosure\n\u2022 Features:\n \u2022 Used in exploit chains\n \u2022 Provides leak primitives\n\u2022 Status:\n \u2022 PoC publicly available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/fevar54/CVE-2026-20805-POC\nhttps://github.com/Uzair-Baig0900/CVE-2026-20805-PoC\n\n\ud83d\udca3 6. CVE-2026-29923 (BYOVD LPE)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Features:\n \u2022 BYOVD (Bring Your Own Vulnerable Driver)\n \u2022 IOCTL-based SYSTEM privilege escalation\n\u2022 Status:\n \u2022 PoC publicly available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/athenasec16/CVE-2026-29923\nhttps://github.com/Smarttfoxx/CVE-2026-29923\n\n\ud83d\udda5 7. CVE-2026-23668 (Windows Graphics)\n\u2022 Type: LPE / RCE\n\u2022 Features:\n \u2022 Race condition vulnerability\n\u2022 Status:\n \u2022 No public GitHub PoC (as of now)\n\n\u26a0\ufe0f Example Attack Chain\nInitial Access (Notepad / MSHTML)\n \u2193\nInfo Leak (DWM - CVE-2026-20805)\n \u2193\nPrivilege Escalation (RedSun / BlueHammer / BYOVD)\n \u2193\nDefender Disable (UnDefend)\n\n\ud83d\udccc Key Takeaways\n\u2714\ufe0f Confirmed GitHub PoCs\n\u2022 BlueHammer\n\u2022 RedSun\n\u2022 UnDefend\n\u2022 CVE-2026-20841\n\u2022 CVE-2026-20805\n\u2022 CVE-2026-29923\n\u2714\ufe0f Full attack chain possible\n\u2192 Initial access \u2192 Info leak \u2192 Privilege escalation \u2192 Defense bypass\n\u2714\ufe0f Current risk level\n\ud83d\udc49 Defender-related vulnerabilities included\n\ud83d\udc49 Some remain unpatched\n\ud83d\udc49 Practical real-world exploitation possible\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:11.958708Z"} 2026-08-28T00:00:11.958708+00:00 https://vulnerability.circl.lu/sighting/293775f8-3676-46e8-8173-0e4cc6e90624/export 2026-10-09T18:33:37.184045+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "293775f8-3676-46e8-8173-0e4cc6e90624", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29923", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17200", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udea8 Windows Zero-Day & Related CVEs (PoC Included)\n\n\ud83e\udde8 1. BlueHammer (CVE-2026-33825)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Impact: User \u2192 SYSTEM privileges\n\u2022 Features:\n \u2022 Exploits Windows Defender update mechanism\n \u2022 TOCTOU + Path Confusion\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Used in real-world attacks\n \u2022 Patched\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/BlueHammer\n\n\ud83d\udd25 2. RedSun (Windows Defender Zero-Day)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Impact: SYSTEM privileges\n\u2022 Features:\n \u2022 Reparse Point + file overwrite\n \u2022 Abuses Defender logic\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Actively exploited\n \u2022 Unpatched in some environments\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/RedSun\n\n\u2620\ufe0f 3. UnDefend\n\u2022 Type: Defender Disable / DoS\n\u2022 Impact:\n \u2022 Blocks Defender updates\n \u2022 Disables security protections\n\u2022 Features:\n \u2022 Works with standard user privileges\n \u2022 Critical in attack chains\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Partially unpatched\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/UnDefend\n\n\ud83d\udca5 4. CVE-2026-20841 (Windows Notepad RCE)\n\u2022 Type: Remote Code Execution (RCE)\n\u2022 Condition:\n \u2022 Opening a malicious Markdown file\n\u2022 Features:\n \u2022 Improper input validation\n \u2022 Multiple PoCs available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/404godd/CVE-2026-20841-PoC\nhttps://github.com/dogukankurnaz/CVE-2026-20841-PoC\nhttps://github.com/hackfaiz/CVE-2026-20841-PoC\nhttps://github.com/tangent65536/CVE-2026-20841\nhttps://github.com/SecureWithUmer/CVE-2026-20841\nhttps://github.com/EleniChristopoulou/PoC-CVE-2026-20841\n\n\ud83d\udd0d 5. CVE-2026-20805 (DWM Info Leak)\n\u2022 Type: Information Disclosure\n\u2022 Features:\n \u2022 Used in exploit chains\n \u2022 Provides leak primitives\n\u2022 Status:\n \u2022 PoC publicly available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/fevar54/CVE-2026-20805-POC\nhttps://github.com/Uzair-Baig0900/CVE-2026-20805-PoC\n\n\ud83d\udca3 6. CVE-2026-29923 (BYOVD LPE)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Features:\n \u2022 BYOVD (Bring Your Own Vulnerable Driver)\n \u2022 IOCTL-based SYSTEM privilege escalation\n\u2022 Status:\n \u2022 PoC publicly available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/athenasec16/CVE-2026-29923\nhttps://github.com/Smarttfoxx/CVE-2026-29923\n\n\ud83d\udda5 7. CVE-2026-23668 (Windows Graphics)\n\u2022 Type: LPE / RCE\n\u2022 Features:\n \u2022 Race condition vulnerability\n\u2022 Status:\n \u2022 No public GitHub PoC (as of now)\n\n\u26a0\ufe0f Example Attack Chain\nInitial Access (Notepad / MSHTML)\n \u2193\nInfo Leak (DWM - CVE-2026-20805)\n \u2193\nPrivilege Escalation (RedSun / BlueHammer / BYOVD)\n \u2193\nDefender Disable (UnDefend)\n\n\ud83d\udccc Key Takeaways\n\u2714\ufe0f Confirmed GitHub PoCs\n\u2022 BlueHammer\n\u2022 RedSun\n\u2022 UnDefend\n\u2022 CVE-2026-20841\n\u2022 CVE-2026-20805\n\u2022 CVE-2026-29923\n\u2714\ufe0f Full attack chain possible\n\u2192 Initial access \u2192 Info leak \u2192 Privilege escalation \u2192 Defense bypass\n\u2714\ufe0f Current risk level\n\ud83d\udc49 Defender-related vulnerabilities included\n\ud83d\udc49 Some remain unpatched\n\ud83d\udc49 Practical real-world exploitation possible\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:04.513491Z"} 2026-08-27T20:00:04.513491+00:00 https://vulnerability.circl.lu/sighting/48a89ab6-2e68-45ea-9244-44cffd9d382a/export 2026-10-09T18:33:37.184178+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "48a89ab6-2e68-45ea-9244-44cffd9d382a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29923", "type": "seen", "source": "https://t.me/cve0day/363", "content": "CVE-2026-29923\n\nThe pstrip64.sys driver in EnTech Taiwan PowerStrip <=3.90.736 allows local users to escalate privileges to SYSTEM via a crafted IOCTL request enabling unprivileged users to map arbitrary physical memory into their address space and modify critical kernel structures.\n\nGitHub Link:\nhttps://github.com/athenasec16/CVE-2026-29923", "creation_timestamp": "2026-08-27T15:00:09.096351Z"} 2026-08-27T15:00:09.096351+00:00 https://vulnerability.circl.lu/sighting/72a73cab-013c-4711-aefd-c4d181bf667b/export 2026-10-09T18:33:37.184284+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "72a73cab-013c-4711-aefd-c4d181bf667b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29923", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/31152", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udea8 Windows Zero-Day & Related CVEs (PoC Included)\n\n\ud83e\udde8 1. BlueHammer (CVE-2026-33825)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Impact: User \u2192 SYSTEM privileges\n\u2022 Features:\n \u2022 Exploits Windows Defender update mechanism\n \u2022 TOCTOU + Path Confusion\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Used in real-world attacks\n \u2022 Patched\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/BlueHammer\n\n\ud83d\udd25 2. RedSun (Windows Defender Zero-Day)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Impact: SYSTEM privileges\n\u2022 Features:\n \u2022 Reparse Point + file overwrite\n \u2022 Abuses Defender logic\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Actively exploited\n \u2022 Unpatched in some environments\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/RedSun\n\n\u2620\ufe0f 3. UnDefend\n\u2022 Type: Defender Disable / DoS\n\u2022 Impact:\n \u2022 Blocks Defender updates\n \u2022 Disables security protections\n\u2022 Features:\n \u2022 Works with standard user privileges\n \u2022 Critical in attack chains\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Partially unpatched\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/UnDefend\n\n\ud83d\udca5 4. CVE-2026-20841 (Windows Notepad RCE)\n\u2022 Type: Remote Code Execution (RCE)\n\u2022 Condition:\n \u2022 Opening a malicious Markdown file\n\u2022 Features:\n \u2022 Improper input validation\n \u2022 Multiple PoCs available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/404godd/CVE-2026-20841-PoC\nhttps://github.com/dogukankurnaz/CVE-2026-20841-PoC\nhttps://github.com/hackfaiz/CVE-2026-20841-PoC\nhttps://github.com/tangent65536/CVE-2026-20841\nhttps://github.com/SecureWithUmer/CVE-2026-20841\nhttps://github.com/EleniChristopoulou/PoC-CVE-2026-20841\n\n\ud83d\udd0d 5. CVE-2026-20805 (DWM Info Leak)\n\u2022 Type: Information Disclosure\n\u2022 Features:\n \u2022 Used in exploit chains\n \u2022 Provides leak primitives\n\u2022 Status:\n \u2022 PoC publicly available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/fevar54/CVE-2026-20805-POC\nhttps://github.com/Uzair-Baig0900/CVE-2026-20805-PoC\n\n\ud83d\udca3 6. CVE-2026-29923 (BYOVD LPE)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Features:\n \u2022 BYOVD (Bring Your Own Vulnerable Driver)\n \u2022 IOCTL-based SYSTEM privilege escalation\n\u2022 Status:\n \u2022 PoC publicly available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/athenasec16/CVE-2026-29923\nhttps://github.com/Smarttfoxx/CVE-2026-29923\n\n\ud83d\udda5 7. CVE-2026-23668 (Windows Graphics)\n\u2022 Type: LPE / RCE\n\u2022 Features:\n \u2022 Race condition vulnerability\n\u2022 Status:\n \u2022 No public GitHub PoC (as of now)\n\n\u26a0\ufe0f Example Attack Chain\nInitial Access (Notepad / MSHTML)\n \u2193\nInfo Leak (DWM - CVE-2026-20805)\n \u2193\nPrivilege Escalation (RedSun / BlueHammer / BYOVD)\n \u2193\nDefender Disable (UnDefend)\n\n\ud83d\udccc Key Takeaways\n\u2714\ufe0f Confirmed GitHub PoCs\n\u2022 BlueHammer\n\u2022 RedSun\n\u2022 UnDefend\n\u2022 CVE-2026-20841\n\u2022 CVE-2026-20805\n\u2022 CVE-2026-29923\n\u2714\ufe0f Full attack chain possible\n\u2192 Initial access \u2192 Info leak \u2192 Privilege escalation \u2192 Defense bypass\n\u2714\ufe0f Current risk level\n\ud83d\udc49 Defender-related vulnerabilities included\n\ud83d\udc49 Some remain unpatched\n\ud83d\udc49 Practical real-world exploitation possible\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:33.616166Z"} 2026-08-16T00:00:33.616166+00:00 https://vulnerability.circl.lu/sighting/899d1198-af10-4dbc-9239-42b4227e665f/export 2026-10-09T18:33:37.184416+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "899d1198-af10-4dbc-9239-42b4227e665f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29923", "type": "seen", "source": "https://t.me/CyberSecurityExploit/31152", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udea8 Windows Zero-Day & Related CVEs (PoC Included)\n\n\ud83e\udde8 1. BlueHammer (CVE-2026-33825)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Impact: User \u2192 SYSTEM privileges\n\u2022 Features:\n \u2022 Exploits Windows Defender update mechanism\n \u2022 TOCTOU + Path Confusion\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Used in real-world attacks\n \u2022 Patched\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/BlueHammer\n\n\ud83d\udd25 2. RedSun (Windows Defender Zero-Day)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Impact: SYSTEM privileges\n\u2022 Features:\n \u2022 Reparse Point + file overwrite\n \u2022 Abuses Defender logic\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Actively exploited\n \u2022 Unpatched in some environments\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/RedSun\n\n\u2620\ufe0f 3. UnDefend\n\u2022 Type: Defender Disable / DoS\n\u2022 Impact:\n \u2022 Blocks Defender updates\n \u2022 Disables security protections\n\u2022 Features:\n \u2022 Works with standard user privileges\n \u2022 Critical in attack chains\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Partially unpatched\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/UnDefend\n\n\ud83d\udca5 4. CVE-2026-20841 (Windows Notepad RCE)\n\u2022 Type: Remote Code Execution (RCE)\n\u2022 Condition:\n \u2022 Opening a malicious Markdown file\n\u2022 Features:\n \u2022 Improper input validation\n \u2022 Multiple PoCs available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/404godd/CVE-2026-20841-PoC\nhttps://github.com/dogukankurnaz/CVE-2026-20841-PoC\nhttps://github.com/hackfaiz/CVE-2026-20841-PoC\nhttps://github.com/tangent65536/CVE-2026-20841\nhttps://github.com/SecureWithUmer/CVE-2026-20841\nhttps://github.com/EleniChristopoulou/PoC-CVE-2026-20841\n\n\ud83d\udd0d 5. CVE-2026-20805 (DWM Info Leak)\n\u2022 Type: Information Disclosure\n\u2022 Features:\n \u2022 Used in exploit chains\n \u2022 Provides leak primitives\n\u2022 Status:\n \u2022 PoC publicly available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/fevar54/CVE-2026-20805-POC\nhttps://github.com/Uzair-Baig0900/CVE-2026-20805-PoC\n\n\ud83d\udca3 6. CVE-2026-29923 (BYOVD LPE)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Features:\n \u2022 BYOVD (Bring Your Own Vulnerable Driver)\n \u2022 IOCTL-based SYSTEM privilege escalation\n\u2022 Status:\n \u2022 PoC publicly available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/athenasec16/CVE-2026-29923\nhttps://github.com/Smarttfoxx/CVE-2026-29923\n\n\ud83d\udda5 7. CVE-2026-23668 (Windows Graphics)\n\u2022 Type: LPE / RCE\n\u2022 Features:\n \u2022 Race condition vulnerability\n\u2022 Status:\n \u2022 No public GitHub PoC (as of now)\n\n\u26a0\ufe0f Example Attack Chain\nInitial Access (Notepad / MSHTML)\n \u2193\nInfo Leak (DWM - CVE-2026-20805)\n \u2193\nPrivilege Escalation (RedSun / BlueHammer / BYOVD)\n \u2193\nDefender Disable (UnDefend)\n\n\ud83d\udccc Key Takeaways\n\u2714\ufe0f Confirmed GitHub PoCs\n\u2022 BlueHammer\n\u2022 RedSun\n\u2022 UnDefend\n\u2022 CVE-2026-20841\n\u2022 CVE-2026-20805\n\u2022 CVE-2026-29923\n\u2714\ufe0f Full attack chain possible\n\u2192 Initial access \u2192 Info leak \u2192 Privilege escalation \u2192 Defense bypass\n\u2714\ufe0f Current risk level\n\ud83d\udc49 Defender-related vulnerabilities included\n\ud83d\udc49 Some remain unpatched\n\ud83d\udc49 Practical real-world exploitation possible\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T12:00:03.044476Z"} 2026-08-15T12:00:03.044476+00:00 https://vulnerability.circl.lu/sighting/d98149fa-fd74-485f-860c-400a8278471b/export 2026-10-09T18:33:37.184534+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d98149fa-fd74-485f-860c-400a8278471b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29923", "type": "seen", "source": "https://t.me/CyberSecurityExploit/31153", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udea8 Windows Zero-Day & Related CVEs (PoC Included)\n\n\ud83e\udde8 1. BlueHammer (CVE-2026-33825)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Impact: User \u2192 SYSTEM privileges\n\u2022 Features:\n \u2022 Exploits Windows Defender update mechanism\n \u2022 TOCTOU + Path Confusion\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Used in real-world attacks\n \u2022 Patched\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/BlueHammer\n\n\ud83d\udd25 2. RedSun (Windows Defender Zero-Day)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Impact: SYSTEM privileges\n\u2022 Features:\n \u2022 Reparse Point + file overwrite\n \u2022 Abuses Defender logic\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Actively exploited\n \u2022 Unpatched in some environments\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/RedSun\n\n\u2620\ufe0f 3. UnDefend\n\u2022 Type: Defender Disable / DoS\n\u2022 Impact:\n \u2022 Blocks Defender updates\n \u2022 Disables security protections\n\u2022 Features:\n \u2022 Works with standard user privileges\n \u2022 Critical in attack chains\n\u2022 Status:\n \u2022 PoC publicly available\n \u2022 Partially unpatched\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/Nightmare-Eclipse/UnDefend\n\n\ud83d\udca5 4. CVE-2026-20841 (Windows Notepad RCE)\n\u2022 Type: Remote Code Execution (RCE)\n\u2022 Condition:\n \u2022 Opening a malicious Markdown file\n\u2022 Features:\n \u2022 Improper input validation\n \u2022 Multiple PoCs available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/404godd/CVE-2026-20841-PoC\nhttps://github.com/dogukankurnaz/CVE-2026-20841-PoC\nhttps://github.com/hackfaiz/CVE-2026-20841-PoC\nhttps://github.com/tangent65536/CVE-2026-20841\nhttps://github.com/SecureWithUmer/CVE-2026-20841\nhttps://github.com/EleniChristopoulou/PoC-CVE-2026-20841\n\n\ud83d\udd0d 5. CVE-2026-20805 (DWM Info Leak)\n\u2022 Type: Information Disclosure\n\u2022 Features:\n \u2022 Used in exploit chains\n \u2022 Provides leak primitives\n\u2022 Status:\n \u2022 PoC publicly available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/fevar54/CVE-2026-20805-POC\nhttps://github.com/Uzair-Baig0900/CVE-2026-20805-PoC\n\n\ud83d\udca3 6. CVE-2026-29923 (BYOVD LPE)\n\u2022 Type: Local Privilege Escalation (LPE)\n\u2022 Features:\n \u2022 BYOVD (Bring Your Own Vulnerable Driver)\n \u2022 IOCTL-based SYSTEM privilege escalation\n\u2022 Status:\n \u2022 PoC publicly available\n\n\ud83d\udccc GitHub PoC\nhttps://github.com/athenasec16/CVE-2026-29923\nhttps://github.com/Smarttfoxx/CVE-2026-29923\n\n\ud83d\udda5 7. CVE-2026-23668 (Windows Graphics)\n\u2022 Type: LPE / RCE\n\u2022 Features:\n \u2022 Race condition vulnerability\n\u2022 Status:\n \u2022 No public GitHub PoC (as of now)\n\n\u26a0\ufe0f Example Attack Chain\nInitial Access (Notepad / MSHTML)\n \u2193\nInfo Leak (DWM - CVE-2026-20805)\n \u2193\nPrivilege Escalation (RedSun / BlueHammer / BYOVD)\n \u2193\nDefender Disable (UnDefend)\n\n\ud83d\udccc Key Takeaways\n\u2714\ufe0f Confirmed GitHub PoCs\n\u2022 BlueHammer\n\u2022 RedSun\n\u2022 UnDefend\n\u2022 CVE-2026-20841\n\u2022 CVE-2026-20805\n\u2022 CVE-2026-29923\n\u2714\ufe0f Full attack chain possible\n\u2192 Initial access \u2192 Info leak \u2192 Privilege escalation \u2192 Defense bypass\n\u2714\ufe0f Current risk level\n\ud83d\udc49 Defender-related vulnerabilities included\n\ud83d\udc49 Some remain unpatched\n\ud83d\udc49 Practical real-world exploitation possible\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T12:00:02.882370Z"} 2026-08-15T12:00:02.882370+00:00 https://vulnerability.circl.lu/sighting/01f902b8-e77c-453a-8f6b-2b353617b4d1/export 2026-10-09T18:33:37.184657+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "01f902b8-e77c-453a-8f6b-2b353617b4d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29923", "type": "seen", "source": "Telegram/yrjrL6C3Okvo70X2GLFpC70dvtNYnso8DgFgZGSIDNHQmnU", "content": "", "creation_timestamp": "2026-05-24T23:00:13.000000Z"} 2026-05-24T23:00:13+00:00 https://vulnerability.circl.lu/sighting/92f159c3-e85a-466b-99c9-410004c63257/export 2026-10-09T18:33:37.184764+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "92f159c3-e85a-466b-99c9-410004c63257", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29923", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mjeg2eo3va2g", "content": "", "creation_timestamp": "2026-04-13T08:09:33.429522Z"} 2026-04-13T08:09:33.429522+00:00 https://vulnerability.circl.lu/sighting/71bee9df-c8bd-460b-a07f-31cdef5a1300/export 2026-10-09T18:33:37.184858+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "71bee9df-c8bd-460b-a07f-31cdef5a1300", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-29923", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mj67urmbr52z", "content": "", "creation_timestamp": "2026-04-10T21:03:04.769946Z"} 2026-04-10T21:03:04.769946+00:00