{"vulnerability": "cve-2021-26865", "sightings": [{"uuid": "75c2bfa5-b0fa-4409-b770-9e0167ab50e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26865", "type": "seen", "source": "https://t.me/cibsecurity/24760", "content": "\u203c CVE-2021-26891 \u203c\n\nWindows Container Execution Agent Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-26865.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-11T18:54:27.000000Z"}, {"uuid": "19b5a737-2aad-4c31-b450-a7ea42870a03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26865", "type": "exploited", "source": "https://t.me/CyberSecurityTechnologies/2835", "content": "#Blue_Team_Techniques\n1. A PowerShell script to identify indicators of exploitation of ProxyLogon (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-26865):\nhttps://github.com/soteria-security/HAFNIUM-IOC\nPoCs for CVE-2021-26855:\n]-> https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2021/CVE-2021-26855.yaml\n]-> https://github.com/h4x0r-dz/CVE-2021-26855\n\n2. The SI6 Networks\u2019 IPv6 toolkit is a set of IPv6 security assessment and trouble-shooting tools\nhttps://www.si6networks.com/research/tools/ipv6toolkit", "creation_timestamp": "2021-03-11T06:06:55.000000Z"}, {"uuid": "f22909ad-cb2f-4a80-baa5-0306de7562dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26865", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3038", "content": "#Research\nNew vulnerabilities in Windows Server Containers: CVE-2021-24096, CVE-2021-26891,\u00a0CVE-2021-26865, CVE-2021-26864\nhttps://googleprojectzero.blogspot.com/2021/04/who-contains-containers.html", "creation_timestamp": "2021-04-02T11:01:09.000000Z"}, {"uuid": "3f8b8dd0-a6ad-4ad5-8ffe-db225828e93a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26865", "type": "seen", "source": "https://t.me/cissp/2852", "content": "Malware analysis\n1. Avaddon RaaS\nhttps://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage\n2. BazarCall malware\nhttps://www.bleepingcomputer.com/news/security/bazarcall-malware-uses-malicious-call-centers-to-infect-victims\n3. Hancitor\u2019s Use of Cobalt Strike and a Noisy Network Ping Tool\nhttps://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike\n\nResearch\nNew vulnerabilities in Windows Server Containers: CVE-2021-24096, \ud83d\ude00CVE-2021-26891,\u00a0CVE-2021-26865, CVE-2021-26864\nhttps://googleprojectzero.blogspot.com/2021/04/who-contains-containers.html", "creation_timestamp": "2026-09-01T17:00:55.899831Z"}, {"uuid": "cc3a3de3-d0b8-4e00-a7f9-0401e13f4beb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26865", "type": "seen", "source": "https://t.me/cissp/2450", "content": "Blue_Team_Techniques\n1. A PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-26865:\nhttps://github.com/soteria-security/HAFNIUM-IOC\n\n2. The SI6 Networks\u2019 IPv6 toolkit is a set of IPv6 security assessment and trouble-shooting tools\nhttps://www.si6networks.com/research/tools/ipv6toolkit\n\nRed_Team_Tactics\n1. SharpSphere - Attacking vSphere/vCenter Infrastructure\nhttps://github.com/JamesCooteUK/SharpSphere\n\n2. Cloudflare XSS WAF Bypass\n\n\n3. SSRF to fetch AWS credentials with full access to multiple services\nhttps://zonduu.medium.com/ssrf-to-fetch-aws-credentials-with-full-access-to-various-services-18cd08194e91\n\nTrojans in Artificial Intelligence\nhttps://www.nist.gov/itl/ssd/trojai\n]-> Pruning-based Baseline Approach to Trojan Detection in AI Models\nhttps://github.com/usnistgov/trojai-baseline-pruning\n]-> The TrojAI Software Framework: An OpenSource tool for Embedding Trojans into Deep Learning Models\nhttps://arxiv.org/abs/2003.07233\n]-> threatspec - continuous threat modeling, through code\nhttps://github.com/threatspec/threatspec", "creation_timestamp": "2026-09-01T17:01:00.898155Z"}, {"uuid": "65751cff-a952-45ae-95d0-9870a526ea89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26865", "type": "seen", "source": "https://t.me/cissp/2852", "content": "Malware analysis\n1. Avaddon RaaS\nhttps://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage\n2. BazarCall malware\nhttps://www.bleepingcomputer.com/news/security/bazarcall-malware-uses-malicious-call-centers-to-infect-victims\n3. Hancitor\u2019s Use of Cobalt Strike and a Noisy Network Ping Tool\nhttps://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike\n\nResearch\nNew vulnerabilities in Windows Server Containers: CVE-2021-24096, \ud83d\ude00CVE-2021-26891,\u00a0CVE-2021-26865, CVE-2021-26864\nhttps://googleprojectzero.blogspot.com/2021/04/who-contains-containers.html", "creation_timestamp": "2026-09-02T01:04:46.426792Z"}, {"uuid": "91e09504-9c2b-432c-8046-19da99cced6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26865", "type": "seen", "source": "https://t.me/cissp/2450", "content": "Blue_Team_Techniques\n1. A PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-26865:\nhttps://github.com/soteria-security/HAFNIUM-IOC\n\n2. The SI6 Networks\u2019 IPv6 toolkit is a set of IPv6 security assessment and trouble-shooting tools\nhttps://www.si6networks.com/research/tools/ipv6toolkit\n\nRed_Team_Tactics\n1. SharpSphere - Attacking vSphere/vCenter Infrastructure\nhttps://github.com/JamesCooteUK/SharpSphere\n\n2. Cloudflare XSS WAF Bypass\n\n\n3. SSRF to fetch AWS credentials with full access to multiple services\nhttps://zonduu.medium.com/ssrf-to-fetch-aws-credentials-with-full-access-to-various-services-18cd08194e91\n\nTrojans in Artificial Intelligence\nhttps://www.nist.gov/itl/ssd/trojai\n]-> Pruning-based Baseline Approach to Trojan Detection in AI Models\nhttps://github.com/usnistgov/trojai-baseline-pruning\n]-> The TrojAI Software Framework: An OpenSource tool for Embedding Trojans into Deep Learning Models\nhttps://arxiv.org/abs/2003.07233\n]-> threatspec - continuous threat modeling, through code\nhttps://github.com/threatspec/threatspec", "creation_timestamp": "2026-09-02T01:04:51.750607Z"}, {"uuid": "98d24be6-623c-4309-9e31-ea8e8369c218", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26865", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2852", "content": "Malware analysis\n1. Avaddon RaaS\nhttps://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage\n2. BazarCall malware\nhttps://www.bleepingcomputer.com/news/security/bazarcall-malware-uses-malicious-call-centers-to-infect-victims\n3. Hancitor\u2019s Use of Cobalt Strike and a Noisy Network Ping Tool\nhttps://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike\n\nResearch\nNew vulnerabilities in Windows Server Containers: CVE-2021-24096, \ud83d\ude00CVE-2021-26891,\u00a0CVE-2021-26865, CVE-2021-26864\nhttps://googleprojectzero.blogspot.com/2021/04/who-contains-containers.html", "creation_timestamp": "2026-09-11T11:00:03.689122Z"}, {"uuid": "e28964d3-c354-47df-8719-8e546a7c994d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26865", "type": "seen", "source": "https://t.me/cissp/2450", "content": "Blue_Team_Techniques\n1. A PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-26865:\nhttps://github.com/soteria-security/HAFNIUM-IOC\n\n2. The SI6 Networks\u2019 IPv6 toolkit is a set of IPv6 security assessment and trouble-shooting tools\nhttps://www.si6networks.com/research/tools/ipv6toolkit\n\nRed_Team_Tactics\n1. SharpSphere - Attacking vSphere/vCenter Infrastructure\nhttps://github.com/JamesCooteUK/SharpSphere\n\n2. Cloudflare XSS WAF Bypass\n\n\n3. SSRF to fetch AWS credentials with full access to multiple services\nhttps://zonduu.medium.com/ssrf-to-fetch-aws-credentials-with-full-access-to-various-services-18cd08194e91\n\nTrojans in Artificial Intelligence\nhttps://www.nist.gov/itl/ssd/trojai\n]-> Pruning-based Baseline Approach to Trojan Detection in AI Models\nhttps://github.com/usnistgov/trojai-baseline-pruning\n]-> The TrojAI Software Framework: An OpenSource tool for Embedding Trojans into Deep Learning Models\nhttps://arxiv.org/abs/2003.07233\n]-> threatspec - continuous threat modeling, through code\nhttps://github.com/threatspec/threatspec", "creation_timestamp": "2026-09-11T18:00:05.276657Z"}, {"uuid": "3a83a14a-5706-427a-bc9c-6b4ccaa09dde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26865", "type": "seen", "source": "https://t.me/cissp/2450", "content": "Blue_Team_Techniques\n1. A PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-26865:\nhttps://github.com/soteria-security/HAFNIUM-IOC\n\n2. The SI6 Networks\u2019 IPv6 toolkit is a set of IPv6 security assessment and trouble-shooting tools\nhttps://www.si6networks.com/research/tools/ipv6toolkit\n\nRed_Team_Tactics\n1. SharpSphere - Attacking vSphere/vCenter Infrastructure\nhttps://github.com/JamesCooteUK/SharpSphere\n\n2. Cloudflare XSS WAF Bypass\n\n\n3. SSRF to fetch AWS credentials with full access to multiple services\nhttps://zonduu.medium.com/ssrf-to-fetch-aws-credentials-with-full-access-to-various-services-18cd08194e91\n\nTrojans in Artificial Intelligence\nhttps://www.nist.gov/itl/ssd/trojai\n]-> Pruning-based Baseline Approach to Trojan Detection in AI Models\nhttps://github.com/usnistgov/trojai-baseline-pruning\n]-> The TrojAI Software Framework: An OpenSource tool for Embedding Trojans into Deep Learning Models\nhttps://arxiv.org/abs/2003.07233\n]-> threatspec - continuous threat modeling, through code\nhttps://github.com/threatspec/threatspec", "creation_timestamp": "2026-09-12T00:00:33.500284Z"}, {"uuid": "b2aaea0b-8305-4155-93e4-2db256033413", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26865", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2852", "content": "Malware analysis\n1. Avaddon RaaS\nhttps://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage\n2. BazarCall malware\nhttps://www.bleepingcomputer.com/news/security/bazarcall-malware-uses-malicious-call-centers-to-infect-victims\n3. Hancitor\u2019s Use of Cobalt Strike and a Noisy Network Ping Tool\nhttps://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike\n\nResearch\nNew vulnerabilities in Windows Server Containers: CVE-2021-24096, \ud83d\ude00CVE-2021-26891,\u00a0CVE-2021-26865, CVE-2021-26864\nhttps://googleprojectzero.blogspot.com/2021/04/who-contains-containers.html", "creation_timestamp": "2026-09-12T00:00:41.386824Z"}]}