{"vulnerability": "CVE-2021-26864", "sightings": [{"uuid": "e6f40fa2-9519-48b4-9f4b-4c225bbc7de9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26864", "type": "seen", "source": "https://t.me/cibsecurity/24782", "content": "\u203c CVE-2021-26864 \u203c\n\nWindows Virtual Registry Provider Elevation of Privilege Vulnerability\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-11T19:00:34.000000Z"}, {"uuid": "286ca69f-2a6e-437c-b7f3-9b13906608a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26864", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2974", "content": "Windows Server Core 20H2 Containers Vulns.:\n1. Host Registry Virtual Registry Provider Bypass EoP in Windows Srv Core 20H2 (PoC for CVE-2021-26864)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2129\n2. AppSilo Object Manager Root Directory EoP\n(PoC for CVE-2021-26891)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2127", "creation_timestamp": "2021-03-24T11:01:11.000000Z"}, {"uuid": "56f34890-0c8a-47c1-85a6-4e544743e766", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26864", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3038", "content": "#Research\nNew vulnerabilities in Windows Server Containers: CVE-2021-24096, CVE-2021-26891,\u00a0CVE-2021-26865, CVE-2021-26864\nhttps://googleprojectzero.blogspot.com/2021/04/who-contains-containers.html", "creation_timestamp": "2021-04-02T11:01:09.000000Z"}, {"uuid": "39c02ee1-5e19-40bf-bbc9-a880dbc8719a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26864", "type": "seen", "source": "https://t.me/cissp/2852", "content": "Malware analysis\n1. Avaddon RaaS\nhttps://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage\n2. BazarCall malware\nhttps://www.bleepingcomputer.com/news/security/bazarcall-malware-uses-malicious-call-centers-to-infect-victims\n3. Hancitor\u2019s Use of Cobalt Strike and a Noisy Network Ping Tool\nhttps://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike\n\nResearch\nNew vulnerabilities in Windows Server Containers: CVE-2021-24096, \ud83d\ude00CVE-2021-26891,\u00a0CVE-2021-26865, CVE-2021-26864\nhttps://googleprojectzero.blogspot.com/2021/04/who-contains-containers.html", "creation_timestamp": "2026-09-01T17:00:55.859841Z"}, {"uuid": "062b574b-fc06-4dda-a806-570b88e200f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26864", "type": "seen", "source": "https://t.me/cissp/2687", "content": "Malware analysis\n1. The \"Kek Security\" Network\nhttps://www.lacework.com/the-kek-security-network\n2. Solitude: A privacy analysis tool\ud83d\ude01\nhttps://research.nccgroup.com/2021/03/17/tool-release-solitude-a-privacy-analysis-tool\n3. RemRAT for Android\nhttps://blogs.360.cn/post/analysis-of-RemRAT.html\n\nWindows Server Core 20H2 Containers Vulns.:\n1. Host Registry Virtual Registry Provider Bypass EoP in Windows Srv \ud83d\ude00Core 20H2 (PoC for CVE-2021-26864)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2129\n2. AppSilo Object Manager Root Directory EoP\n(PoC for CVE-2021-26891)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2127\n\nRed Team Tactics\n1. A Novel Technique to Hide Bookmarks\nhttps://jstrieb.github.io/projects/hidden-bookmarks\n2. Mindmaps, bugbounty tips, red teaming tips\u270c\ud83c\udffc\nhttps://github.com/hackerscrolls/SecurityTips", "creation_timestamp": "2026-09-01T17:00:57.486237Z"}, {"uuid": "26be43d0-be5e-431b-911b-751d530bd25b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26864", "type": "seen", "source": "https://t.me/cissp/2852", "content": "Malware analysis\n1. Avaddon RaaS\nhttps://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage\n2. BazarCall malware\nhttps://www.bleepingcomputer.com/news/security/bazarcall-malware-uses-malicious-call-centers-to-infect-victims\n3. Hancitor\u2019s Use of Cobalt Strike and a Noisy Network Ping Tool\nhttps://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike\n\nResearch\nNew vulnerabilities in Windows Server Containers: CVE-2021-24096, \ud83d\ude00CVE-2021-26891,\u00a0CVE-2021-26865, CVE-2021-26864\nhttps://googleprojectzero.blogspot.com/2021/04/who-contains-containers.html", "creation_timestamp": "2026-09-02T01:04:46.379946Z"}, {"uuid": "8445ad41-bde0-4fb6-8dbf-ce414818e5f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26864", "type": "seen", "source": "https://t.me/cissp/2687", "content": "Malware analysis\n1. The \"Kek Security\" Network\nhttps://www.lacework.com/the-kek-security-network\n2. Solitude: A privacy analysis tool\ud83d\ude01\nhttps://research.nccgroup.com/2021/03/17/tool-release-solitude-a-privacy-analysis-tool\n3. RemRAT for Android\nhttps://blogs.360.cn/post/analysis-of-RemRAT.html\n\nWindows Server Core 20H2 Containers Vulns.:\n1. Host Registry Virtual Registry Provider Bypass EoP in Windows Srv \ud83d\ude00Core 20H2 (PoC for CVE-2021-26864)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2129\n2. AppSilo Object Manager Root Directory EoP\n(PoC for CVE-2021-26891)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2127\n\nRed Team Tactics\n1. A Novel Technique to Hide Bookmarks\nhttps://jstrieb.github.io/projects/hidden-bookmarks\n2. Mindmaps, bugbounty tips, red teaming tips\u270c\ud83c\udffc\nhttps://github.com/hackerscrolls/SecurityTips", "creation_timestamp": "2026-09-02T01:04:48.000047Z"}, {"uuid": "0b82b229-0d49-4bc6-90c8-499591636024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26864", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2852", "content": "Malware analysis\n1. Avaddon RaaS\nhttps://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage\n2. BazarCall malware\nhttps://www.bleepingcomputer.com/news/security/bazarcall-malware-uses-malicious-call-centers-to-infect-victims\n3. Hancitor\u2019s Use of Cobalt Strike and a Noisy Network Ping Tool\nhttps://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike\n\nResearch\nNew vulnerabilities in Windows Server Containers: CVE-2021-24096, \ud83d\ude00CVE-2021-26891,\u00a0CVE-2021-26865, CVE-2021-26864\nhttps://googleprojectzero.blogspot.com/2021/04/who-contains-containers.html", "creation_timestamp": "2026-09-11T11:00:03.744584Z"}, {"uuid": "75d09526-2b6e-4e48-b1c7-d61805781838", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26864", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2687", "content": "Malware analysis\n1. The \"Kek Security\" Network\nhttps://www.lacework.com/the-kek-security-network\n2. Solitude: A privacy analysis tool\ud83d\ude01\nhttps://research.nccgroup.com/2021/03/17/tool-release-solitude-a-privacy-analysis-tool\n3. RemRAT for Android\nhttps://blogs.360.cn/post/analysis-of-RemRAT.html\n\nWindows Server Core 20H2 Containers Vulns.:\n1. Host Registry Virtual Registry Provider Bypass EoP in Windows Srv \ud83d\ude00Core 20H2 (PoC for CVE-2021-26864)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2129\n2. AppSilo Object Manager Root Directory EoP\n(PoC for CVE-2021-26891)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2127\n\nRed Team Tactics\n1. A Novel Technique to Hide Bookmarks\nhttps://jstrieb.github.io/projects/hidden-bookmarks\n2. Mindmaps, bugbounty tips, red teaming tips\u270c\ud83c\udffc\nhttps://github.com/hackerscrolls/SecurityTips", "creation_timestamp": "2026-09-11T14:00:05.396542Z"}, {"uuid": "3b2953c7-ce05-40b4-8af9-72023123bb8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26864", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2687", "content": "Malware analysis\n1. The \"Kek Security\" Network\nhttps://www.lacework.com/the-kek-security-network\n2. Solitude: A privacy analysis tool\ud83d\ude01\nhttps://research.nccgroup.com/2021/03/17/tool-release-solitude-a-privacy-analysis-tool\n3. RemRAT for Android\nhttps://blogs.360.cn/post/analysis-of-RemRAT.html\n\nWindows Server Core 20H2 Containers Vulns.:\n1. Host Registry Virtual Registry Provider Bypass EoP in Windows Srv \ud83d\ude00Core 20H2 (PoC for CVE-2021-26864)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2129\n2. AppSilo Object Manager Root Directory EoP\n(PoC for CVE-2021-26891)\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2127\n\nRed Team Tactics\n1. A Novel Technique to Hide Bookmarks\nhttps://jstrieb.github.io/projects/hidden-bookmarks\n2. Mindmaps, bugbounty tips, red teaming tips\u270c\ud83c\udffc\nhttps://github.com/hackerscrolls/SecurityTips", "creation_timestamp": "2026-09-12T00:00:39.572394Z"}, {"uuid": "d3e5d148-ec26-42c2-87c9-2f3f01ebdef8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26864", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2852", "content": "Malware analysis\n1. Avaddon RaaS\nhttps://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage\n2. BazarCall malware\nhttps://www.bleepingcomputer.com/news/security/bazarcall-malware-uses-malicious-call-centers-to-infect-victims\n3. Hancitor\u2019s Use of Cobalt Strike and a Noisy Network Ping Tool\nhttps://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike\n\nResearch\nNew vulnerabilities in Windows Server Containers: CVE-2021-24096, \ud83d\ude00CVE-2021-26891,\u00a0CVE-2021-26865, CVE-2021-26864\nhttps://googleprojectzero.blogspot.com/2021/04/who-contains-containers.html", "creation_timestamp": "2026-09-12T00:00:41.426178Z"}]}