{"vulnerability": "cve-2026-2429", "sightings": [{"uuid": "8b2296a9-2990-472f-9fd5-91fd15ad443c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24297", "type": "seen", "source": "https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review", "content": "", "creation_timestamp": "2026-03-10T16:57:37.000000Z"}, {"uuid": "ccf1a886-a6cb-4dc7-8f81-d3062e3de17f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24290", "type": "seen", "source": "https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review", "content": "", "creation_timestamp": "2026-03-10T16:57:37.000000Z"}, {"uuid": "f0b60fe7-17d3-46b8-ae08-fed162f10972", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2429", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mggvusd36s2u", "content": "", "creation_timestamp": "2026-03-07T03:42:30.654488Z"}, {"uuid": "78495e89-8dda-4929-bc61-f4e1209cdef1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24294", "type": "seen", "source": "https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review", "content": "", "creation_timestamp": "2026-03-10T16:57:37.000000Z"}, {"uuid": "1cc14dee-a98a-4afc-bea1-6d39274a41a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24290", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0080", "content": "", "creation_timestamp": "2026-03-10T19:07:55.000000Z"}, {"uuid": "9c140ef0-d012-4a95-b461-5c7b415700cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24295", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0080", "content": "", "creation_timestamp": "2026-03-10T19:07:55.000000Z"}, {"uuid": "cbaf6854-c741-4a2b-91c3-afd16792822f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24296", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0080", "content": "", "creation_timestamp": "2026-03-10T19:07:55.000000Z"}, {"uuid": "092b251b-9cc8-473c-ae9f-31f36a92680c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0080", "content": "", "creation_timestamp": "2026-03-10T19:07:55.000000Z"}, {"uuid": "71288b8e-c4dd-4ae9-b09d-7d5aca25f823", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24294", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0080", "content": "", "creation_timestamp": "2026-03-10T19:07:55.000000Z"}, {"uuid": "13ed400a-d8b3-4f73-a032-d7e0ed0a836b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24292", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0080", "content": "", "creation_timestamp": "2026-03-10T19:07:55.000000Z"}, {"uuid": "9e1bee0c-4111-4fd9-abe5-b5febc9f7487", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24293", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0080", "content": "", "creation_timestamp": "2026-03-10T19:07:55.000000Z"}, {"uuid": "4cd2c5bc-77af-4ac9-9317-2598f7f20e77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://krebsonsecurity.com/2026/03/microsoft-patch-tuesday-march-2026-edition/", "content": "", "creation_timestamp": "2026-03-10T23:32:51.000000Z"}, {"uuid": "9d2d23e3-3ba4-4919-aaa2-f061e99818a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24294", "type": "seen", "source": "https://krebsonsecurity.com/2026/03/microsoft-patch-tuesday-march-2026-edition/", "content": "", "creation_timestamp": "2026-03-10T23:32:51.000000Z"}, {"uuid": "5b7065fb-60bd-4e47-8d94-2f220b0538d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review", "content": "", "creation_timestamp": "2026-03-10T16:57:37.000000Z"}, {"uuid": "87d9ef6d-b4c8-4b82-8fcd-4139715c51cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24293", "type": "seen", "source": "https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review", "content": "", "creation_timestamp": "2026-03-10T16:57:37.000000Z"}, {"uuid": "ddc1a168-5fd8-4926-b385-321404e3ec92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24292", "type": "seen", "source": "https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review", "content": "", "creation_timestamp": "2026-03-10T16:57:37.000000Z"}, {"uuid": "5f03ce9f-55ab-4d0f-9c9b-c88644964824", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24295", "type": "seen", "source": "https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review", "content": "", "creation_timestamp": "2026-03-10T16:57:37.000000Z"}, {"uuid": "b1ef6fb7-2335-4a41-8d86-4aeaaa37df78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24296", "type": "seen", "source": "https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review", "content": "", "creation_timestamp": "2026-03-10T16:57:37.000000Z"}, {"uuid": "246bb918-5722-4c2a-9ded-b569415bb689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24297", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0080", "content": "", "creation_timestamp": "2026-03-10T19:07:55.000000Z"}, {"uuid": "2b943445-c847-4300-9a8f-3f259d063193", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24299", "type": "seen", "source": "https://bsky.app/profile/wiert.bsky.social/post/3mhoccouttk2b", "content": "", "creation_timestamp": "2026-03-22T19:38:52.469538Z"}, {"uuid": "0ed23125-2116-45ff-b529-0dbca665c2fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24290", "type": "seen", "source": "https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+March+2026/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:16.000000Z"}, {"uuid": "10e3ac1c-d6fb-4755-a029-9ef36eb5d0ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24294", "type": "seen", "source": "https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+March+2026/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:16.000000Z"}, {"uuid": "4e6d9ddf-a4d7-4712-bac8-42fc9e01fc6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+March+2026/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:16.000000Z"}, {"uuid": "b7601a03-52c4-4eb3-bc3d-d622a2244817", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24292", "type": "seen", "source": "https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+March+2026/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:16.000000Z"}, {"uuid": "6d0fef85-9712-41d1-8b42-8234ecce1f28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24296", "type": "seen", "source": "https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+March+2026/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:16.000000Z"}, {"uuid": "294493e7-65a7-403c-92e5-22e4a705723e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24297", "type": "seen", "source": "https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+March+2026/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:16.000000Z"}, {"uuid": "06b0e12e-3f69-4e18-ae62-b5fae2f508f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24293", "type": "seen", "source": "https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+March+2026/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:16.000000Z"}, {"uuid": "55204a46-2223-4e0a-9976-9c1ffa38dfc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24295", "type": "seen", "source": "https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+March+2026/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:16.000000Z"}, {"uuid": "ab743a85-c6aa-4f59-a04c-1fa01b42202f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24293", "type": "seen", "source": "https://isc.sans.edu/diary/rss/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:20.000000Z"}, {"uuid": "1337e4f2-ff85-4c74-98d1-9cb310c32a68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mi72ygcdxt2l", "content": "", "creation_timestamp": "2026-03-29T11:43:06.661009Z"}, {"uuid": "e6f84ac5-37a2-423d-851c-c92f8b3f35dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://isc.sans.edu/diary/rss/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:20.000000Z"}, {"uuid": "b60d7f46-a96a-44d3-a023-daab3f0b7c6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24292", "type": "seen", "source": "https://isc.sans.edu/diary/rss/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:20.000000Z"}, {"uuid": "d43d1bdf-4565-4be4-a41c-b5a02ae5db36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24295", "type": "seen", "source": "https://isc.sans.edu/diary/rss/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:20.000000Z"}, {"uuid": "837d0af0-de7f-4afa-bb1b-868c29b7ab3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24297", "type": "seen", "source": "https://isc.sans.edu/diary/rss/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:20.000000Z"}, {"uuid": "fd21750a-98f5-47ae-b550-153858daef86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24296", "type": "seen", "source": "https://isc.sans.edu/diary/rss/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:20.000000Z"}, {"uuid": "2fa29a9b-f94a-4f32-b8c6-38d76af145bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24294", "type": "seen", "source": "https://isc.sans.edu/diary/rss/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:20.000000Z"}, {"uuid": "55dced6f-1f11-440b-b506-9cc9af823481", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24290", "type": "seen", "source": "https://isc.sans.edu/diary/rss/32782", "content": "", "creation_timestamp": "2026-03-11T03:00:20.000000Z"}, {"uuid": "66d4dfa7-5987-47f8-8a41-7a4b5b5561ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-24291", "type": "seen", "source": "https://social.tchncs.de/users/gborn/statuses/116260572278544310", "content": "", "creation_timestamp": "2026-03-20T08:32:29.224190Z"}, {"uuid": "ce341438-f858-4652-883e-6b102d3c4bba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mhglpz2thw2m", "content": "", "creation_timestamp": "2026-03-19T18:06:04.659009Z"}, {"uuid": "9e107e4d-a8c5-4a62-864f-5d63a5179767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mhlpqohd632m", "content": "", "creation_timestamp": "2026-03-21T19:01:20.622260Z"}, {"uuid": "1cf2b53d-430a-4e5b-990f-8f4e8cd728b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-24291", "type": "published-proof-of-concept", "source": "https://github.com/mdsecactivebreach/RegPwn", "content": "", "creation_timestamp": "2026-03-12T17:00:00.000000Z"}, {"uuid": "197d52b6-2413-447e-81f9-9652ea411842", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://bsky.app/profile/g0rosato.bsky.social/post/3miz2afb7yr2v", "content": "", "creation_timestamp": "2026-04-08T19:38:53.554436Z"}, {"uuid": "ad8e9dad-4de6-42ce-900b-589dc45a5481", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/77307", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a RegPwn\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tracyliving606\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C#\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-03-26 09:44:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit Windows local privilege escalation on clients and servers using tested code for CVE-2026-24291 across multiple Windows versions\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-03-26T10:00:04.000000Z"}, {"uuid": "1cc0681f-e05d-4185-b25d-3b8ccf602c01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24299", "type": "seen", "source": "https://bsky.app/profile/hnws.bsky.social/post/3mrt5pz6mij2a", "content": "Copirate 365: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299)\ncomments \u00b7 posted on 2026.07.29 at 17:37:15 (c=0, p=4)", "creation_timestamp": "2026-07-30T00:12:04.621626Z"}, {"uuid": "672a5cef-63f4-4f47-9697-81cfb31cd704", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24299", "type": "seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3mrt5q2vhh72z", "content": "Copirate 365: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299)\n\nDiscussion", "creation_timestamp": "2026-07-30T00:12:06.435002Z"}, {"uuid": "fb7fb2a8-7114-4547-a502-15666e7f929c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-24299", "type": "seen", "source": "https://bsky.app/profile/rhodzy.com/post/3msc7uhjgvh2l", "content": "New blog post: Copilot: More Like Copirate If You're Not Careful\n\nMicrosoft Copilot is everywhere, but a recent CVE shows it's not all sunshine and AI...\n\nhttps://rhodzy.com/blog/copilot-more-like-copirate-if-youre-not-careful\n\n#microsoftcopilot #aisecurity #enterpriseit #cve-2026-24299 #techopinion", "creation_timestamp": "2026-08-05T00:00:17.630669Z"}, {"uuid": "c31c1c7a-6598-4f24-993a-193a82eeeb99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24294", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/343", "content": "BYPASSING WINDOWS AUTHENTICATION REFLECTION MITIGATIONS FOR SYSTEM SHELLS - PART \u2461\n\nA new arbitrary Kerberos coercion technique (CVE-2026-26128) that led to a complete bypass of the patch of CVE-2025-33073. This short-lived RCE was then transformed into a universal LPE attack.\n\nBYPASSING WINDOWS AUTHENTICATION REFLECTION MITIGATIONS FOR SYSTEM SHELLS - PART 1\n\nAbuse of a new feature of recent Windows versions, namely the ability to connect to SMB shares on arbitrary TCP ports, to achieve local privilege escalation\u00a0(CVE-2026-24294) on up-to-date Windows Server 2025 machines.", "creation_timestamp": "2026-05-02T06:09:03.000000Z"}, {"uuid": "a04a6df4-8c34-44b0-a4ff-3ed3e2410721", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24294", "type": "seen", "source": "Telegram/yjUnQ6hKYXBxzaCr4Cr42UE0MHqi1VzU3UchLcz_NxtZwAY", "content": "", "creation_timestamp": "2026-04-30T09:00:04.000000Z"}, {"uuid": "ca702bc5-55e5-43b5-b644-3ced397f3640", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24294", "type": "seen", "source": "Telegram/GBpYOLFByJUZNo27RsDzztksilkUG3XAg7CrsrR5OqI_xQ", "content": "", "creation_timestamp": "2026-05-02T13:21:19.000000Z"}, {"uuid": "845f17d6-8431-484f-ae1f-d4358535d16d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24299", "type": "seen", "source": "Telegram/17cmREU9ZDSDvyz78F9oo9Lr_unjD9vL2ztNU0fhrgd68AR1", "content": "", "creation_timestamp": "2026-05-04T13:15:05.000000Z"}, {"uuid": "6e5d0977-6a7b-4022-b269-a027023ae555", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24299", "type": "seen", "source": "https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mkzxscfe5bu2", "content": "Copirate 365 at DEF CON: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299) https://embracethered.com/blog/posts/2026/defcon-talk-copirate-365/", "creation_timestamp": "2026-05-04T15:21:52.678481Z"}, {"uuid": "6babbed5-3900-4140-a7a5-5d847ffbecc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24299", "type": "seen", "source": "https://bsky.app/profile/warthogtk.bsky.social/post/3ml4zuqd7f22t", "content": "Copirate 365 at DEF CON: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299) \u00b7  Embrace The Red embracethered.com/blog/posts/2...", "creation_timestamp": "2026-05-05T20:33:24.740866Z"}, {"uuid": "44e2b14e-9858-4392-9122-56abd92c8fc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://infosec.exchange/users/0patch/statuses/116601532783321868", "content": "Micropatches released  for Windows Accessibility Infrastructure Elevation of Privilege  Vulnerability (CVE-2026-24291, CVE-2026-25186, CVE-2026-25187) https://blog.0patch.com/2026/05/micropatches-released-for-windows.html", "creation_timestamp": "2026-05-19T13:43:15.281244Z"}, {"uuid": "81cd9175-b7c7-48d9-845a-5ac991c97690", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mma33thltp25", "content": "Micropatches released for Windows Accessibility Infrastructure Elevation of Privilege Vulnerability (CVE-2026-24291, CVE-2026-25186, CVE-2026-25187)", "creation_timestamp": "2026-05-19T18:58:29.146853Z"}, {"uuid": "1c90ffec-1c65-40db-94ce-926677d9b04c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-24299", "type": "seen", "source": "https://bsky.app/profile/rhodzy.com/post/3mscd7uumh32e", "content": "New blog post: Copilot: More Like Copi-leak, Eh?\n\nMicrosoft Copilot is being touted as the next big thing, but a recent DEF CON finding highlights some proper security ...\n\nhttps://rhodzy.com/blog/copilot-more-like-copi-leak-eh\n\n#microsoftcopilot #aisecurity #dataprivacy #techopinion #cve-2026-24299", "creation_timestamp": "2026-08-05T01:00:21.923720Z"}, {"uuid": "8e0f4dcb-a8ce-4a02-9795-79b4949f6cf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-24299", "type": "seen", "source": "https://bsky.app/profile/rhodzy.com/post/3mscgl4mhye2m", "content": "New blog post: Copilot 365: Another Day, Another Data Hole\n\nThe \"Copirate 365\" talk at DEF CON wasn't exactly a shocker, was it? Letting an AI rummage through your ent...\n\nhttps://rhodzy.com/blog/copilot-365-another-day-another-data-hole\n\n#microsoftcopilot #ai #security #cve-2026-24299 #microsoft365", "creation_timestamp": "2026-08-05T02:00:20.271819Z"}, {"uuid": "4009db35-15f3-4e6a-9d83-3ee2c634c65b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-24299", "type": "seen", "source": "https://bsky.app/profile/rhodzy.com/post/3msctydyhsw27", "content": "New blog post: Microsoft Copilot: More Like Copirate, Eh?\n\nMicrosoft Copilot promised a lot, but recent security issues show it's got some serious fla...\n\nhttps://rhodzy.com/blog/microsoft-copilot-more-like-copirate-eh\n\n#microsoftcopilot #cybersecurity #ai #datasecurity #microsoft365 #cve-2026-24299", "creation_timestamp": "2026-08-05T06:00:22.816082Z"}, {"uuid": "3bce637e-5dcb-4a4d-9460-f79b8c9387f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-24299", "type": "seen", "source": "https://bsky.app/profile/rhodzy.com/post/3msd6262ob522", "content": "New blog post: Copilot: Another Day, Another Security Bollocks\n\nMicrosoft Copilot was meant to be the future, but turns out it's got more holes tha...\n\nhttps://rhodzy.com/blog/copilot-another-day-another-security-bollocks\n\n#microsoftcopilot #aisecurity #promptinjection #cybersecurity #cve-2026-24299", "creation_timestamp": "2026-08-05T09:00:21.153317Z"}, {"uuid": "8baa20a2-5e02-4b45-a0b6-a9b78a820456", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-24299", "type": "seen", "source": "https://bsky.app/profile/rhodzy.com/post/3msecwljtk725", "content": "New blog post: Copilot's Dirty Little Secret: When Your AI Mate Turns Pirate\n\nMicrosoft Copilot is everywhere, promising the wo...\n\nhttps://rhodzy.com/blog/copilots-dirty-little-secret-when-your-ai-mate-turns-pirate\n\n#microsoftcopilot #aisecurity #cve-2026-24299 #infosec #microsoft365 #cybersecurity", "creation_timestamp": "2026-08-05T20:00:29.519115Z"}, {"uuid": "b1140e61-bf3e-47fc-a719-832336412fde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24294", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mpg4kkkmog23", "content": "Researcher publicly disclosed an NTLM reflection bypass, CVE-2026-24294, with PoC exploit code. It gives SYSTEM on Windows Server 2025. Patch now.\n\n#NTLM #NTLMReflection #CVE202624294 #Windows #PrivEsc #Cybersecurity #Infosec", "creation_timestamp": "2026-06-29T08:56:08.774693Z"}, {"uuid": "55277823-b9c3-4159-8f11-1f5105ea5600", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24294", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mphsjry5qw2u", "content": "NTLM\u30ea\u30d5\u30ec\u30af\u30b7\u30e7\u30f3\u30d0\u30a4\u30d1\u30b9CVE-2026-24294\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3059\u308bPoC\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u304c\u516c\u958b\u3055\u308c\u308b \n\nNTLM Reflection Bypass CVE-2026-24294 Gets Public PoC Exploit  #DailyCyberSecurity (Jun 29)\n\nsecurityonline.info/ntlm-reflect...", "creation_timestamp": "2026-06-30T01:02:04.156931Z"}, {"uuid": "9fdce2cf-0685-4069-8d2a-7573bfbf4b97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24294", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mpixq7m7rf2t", "content": "\ufffd Windows NTLM Reflection Bypass Exposes SYSTEM-Level Control on Fully Patched Systems (CVE-2025-33073 \u2192 CVE-2026-24294) +\u00a0Video\n\n\ud83e\udde0 Introduction: When \u201cFully Patched\u201d Still Means Fully Exposed A system that claims to be secure after updates should inspire confidence, not concern. Yet the discovery\u2026", "creation_timestamp": "2026-06-30T12:07:52.874869Z"}, {"uuid": "e9775419-e79f-4b22-86f4-23ada30175c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://t.me/CyberSecurityExploit/30204", "content": "\ud83d\udd25 Windows LPE Exploit \u2014 RegPwn (CVE-2026-24291)\n\u2694\ufe0f Registry Symlink Privilege Escalation via Accessibility Mechanism\n\n\ud83d\udccc Research / Blog\n\ud83d\udc49https://www.mdsec.co.uk/2026/03/rip-regpwn/\n\n\ud83d\udccc GitHub (Exploit)\n\ud83d\udc49https://github.com/mdsecactivebreach/RegPwn\n\n\ud83d\udccc GitHub (BOF / Cobalt Strike)\n\ud83d\udc49https://github.com/Flangvik/RegPwnBOF\n\n\ud83d\udcd6 Description\nRegPwn is a Local Privilege Escalation (LPE) vulnerability in Windows\naffecting Windows 10, Windows 11, and multiple Windows Server versions.\n\nIt was discovered and used internally by MDSec during Red Team operations\nsince early 2025, and later patched in March 2026.\n\nTracked as:\n\ud83d\udc49 CVE-2026-24291\n\n\u2699\ufe0f Vulnerability Overview\nThe issue exists in the Windows Accessibility (ATBroker / ATConfig) mechanism.\nMisconfigured registry permissions\nUser-controlled registry data copied into privileged context\nWritable HKLM registry path exposed to low-priv users\n\ud83d\udc49 Leads to arbitrary registry write as SYSTEM\nAccording to CVE:\nIncorrect permission assignment allows local privilege escalation\n\n\ud83e\udde0 Exploitation Concept\nRegistry Flow Abuse\nHKCU (User Controlled)\n        \u2193\nHKLM Session Key (Writable)\n        \u2193\nHKU\\.DEFAULT (SYSTEM Context)\n        \u2193\nSYSTEM Process Execution\n\nCore Technique\n\u2022 Registry Symlink Abuse\n\u2022 Race Condition (Oplock)\n\u2022 Accessibility Feature Trigger (osk.exe)\n\ud83d\udc49 Result:\nLow Priv User \u2192 SYSTEM Privilege\n\n\u2694\ufe0f Exploit Details\nThe exploit abuses:\n\u2022 Accessibility configuration registry keys\n\u2022 Secure Desktop behavior\n\u2022 ATbroker.exe interaction\n\u2022 osk.exe execution timing\n\ud83d\udc49 By combining:\n\u2022 Opportunistic Lock (Oplock)\n\u2022 Registry Symbolic Link\nAn attacker can redirect writes to arbitrary SYSTEM registry locations\n\n\ud83d\udca3 Practical Impact\n\u2022 Local Privilege Escalation (LPE)\n\u2022 Full SYSTEM access\n\u2022 Service ImagePath hijacking\n\u2022 Payload execution as SYSTEM\n\n\ud83e\uddec GitHub \u2014 Exploit Implementation\n\u2699\ufe0f RegPwn (Original Exploit)\n\u2022 Language: C#\n\u2022 Targets:\n   \u2022 Windows 10 / 11\n   \u2022 Windows Server 2016 / 2019 / 2022\n   \u2022 Based on blog research\n\ud83d\udc49 Direct PoC for LPE\n\n\u2694\ufe0f RegPwnBOF (Cobalt Strike BOF)\n\u2022 BOF implementation of exploit\n\u2022 Designed for post-exploitation use\n\u2022 Supports:\nbeacon> regpwn payload.exe\n\ud83d\udc49 Enables SYSTEM escalation inside C2 operations\n\n\ud83e\udde0 Red Team Insight\nReal-World Usage Flow\nInitial Access\n     \u2193\nBeacon / Agent\n     \u2193\nRegPwn Execution\n     \u2193\nSYSTEM Privilege\n     \u2193\nLateral Movement / Persistence\n\nWhy This Matters\n\u2714\ufe0f Works on multiple Windows versions\n\u2714\ufe0f Reliable LPE vector\n\u2714\ufe0f BOF integration available\n\u2714\ufe0f Useful for post-exploitation chains\n\n\ud83d\ude80 Key Takeaways\n\u2022 Accessibility features can expose privileged pathways\n\u2022 Registry permission misconfig = critical attack surface\n\u2022 Race conditions + symlink = powerful LPE combo\n\u2022 Direct integration into C2 frameworks\n\n\u26a0\ufe0f Patch Status\n\u2714\ufe0f Fixed in March 2026 Patch Tuesday\n\u2714\ufe0f Affects pre-patch Windows environments\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T11:00:06.412537Z"}, {"uuid": "7a3f113c-1dce-47f4-a4fc-3848fce7c78c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30204", "content": "\ud83d\udd25 Windows LPE Exploit \u2014 RegPwn (CVE-2026-24291)\n\u2694\ufe0f Registry Symlink Privilege Escalation via Accessibility Mechanism\n\n\ud83d\udccc Research / Blog\n\ud83d\udc49https://www.mdsec.co.uk/2026/03/rip-regpwn/\n\n\ud83d\udccc GitHub (Exploit)\n\ud83d\udc49https://github.com/mdsecactivebreach/RegPwn\n\n\ud83d\udccc GitHub (BOF / Cobalt Strike)\n\ud83d\udc49https://github.com/Flangvik/RegPwnBOF\n\n\ud83d\udcd6 Description\nRegPwn is a Local Privilege Escalation (LPE) vulnerability in Windows\naffecting Windows 10, Windows 11, and multiple Windows Server versions.\n\nIt was discovered and used internally by MDSec during Red Team operations\nsince early 2025, and later patched in March 2026.\n\nTracked as:\n\ud83d\udc49 CVE-2026-24291\n\n\u2699\ufe0f Vulnerability Overview\nThe issue exists in the Windows Accessibility (ATBroker / ATConfig) mechanism.\nMisconfigured registry permissions\nUser-controlled registry data copied into privileged context\nWritable HKLM registry path exposed to low-priv users\n\ud83d\udc49 Leads to arbitrary registry write as SYSTEM\nAccording to CVE:\nIncorrect permission assignment allows local privilege escalation\n\n\ud83e\udde0 Exploitation Concept\nRegistry Flow Abuse\nHKCU (User Controlled)\n        \u2193\nHKLM Session Key (Writable)\n        \u2193\nHKU\\.DEFAULT (SYSTEM Context)\n        \u2193\nSYSTEM Process Execution\n\nCore Technique\n\u2022 Registry Symlink Abuse\n\u2022 Race Condition (Oplock)\n\u2022 Accessibility Feature Trigger (osk.exe)\n\ud83d\udc49 Result:\nLow Priv User \u2192 SYSTEM Privilege\n\n\u2694\ufe0f Exploit Details\nThe exploit abuses:\n\u2022 Accessibility configuration registry keys\n\u2022 Secure Desktop behavior\n\u2022 ATbroker.exe interaction\n\u2022 osk.exe execution timing\n\ud83d\udc49 By combining:\n\u2022 Opportunistic Lock (Oplock)\n\u2022 Registry Symbolic Link\nAn attacker can redirect writes to arbitrary SYSTEM registry locations\n\n\ud83d\udca3 Practical Impact\n\u2022 Local Privilege Escalation (LPE)\n\u2022 Full SYSTEM access\n\u2022 Service ImagePath hijacking\n\u2022 Payload execution as SYSTEM\n\n\ud83e\uddec GitHub \u2014 Exploit Implementation\n\u2699\ufe0f RegPwn (Original Exploit)\n\u2022 Language: C#\n\u2022 Targets:\n   \u2022 Windows 10 / 11\n   \u2022 Windows Server 2016 / 2019 / 2022\n   \u2022 Based on blog research\n\ud83d\udc49 Direct PoC for LPE\n\n\u2694\ufe0f RegPwnBOF (Cobalt Strike BOF)\n\u2022 BOF implementation of exploit\n\u2022 Designed for post-exploitation use\n\u2022 Supports:\nbeacon> regpwn payload.exe\n\ud83d\udc49 Enables SYSTEM escalation inside C2 operations\n\n\ud83e\udde0 Red Team Insight\nReal-World Usage Flow\nInitial Access\n     \u2193\nBeacon / Agent\n     \u2193\nRegPwn Execution\n     \u2193\nSYSTEM Privilege\n     \u2193\nLateral Movement / Persistence\n\nWhy This Matters\n\u2714\ufe0f Works on multiple Windows versions\n\u2714\ufe0f Reliable LPE vector\n\u2714\ufe0f BOF integration available\n\u2714\ufe0f Useful for post-exploitation chains\n\n\ud83d\ude80 Key Takeaways\n\u2022 Accessibility features can expose privileged pathways\n\u2022 Registry permission misconfig = critical attack surface\n\u2022 Race conditions + symlink = powerful LPE combo\n\u2022 Direct integration into C2 frameworks\n\n\u26a0\ufe0f Patch Status\n\u2714\ufe0f Fixed in March 2026 Patch Tuesday\n\u2714\ufe0f Affects pre-patch Windows environments\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:34.990120Z"}, {"uuid": "9bc97306-8c14-454b-b544-dbf2a7f281b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17069", "content": "\ud83d\udd25 Windows LPE Exploit \u2014 RegPwn (CVE-2026-24291)\n\u2694\ufe0f Registry Symlink Privilege Escalation via Accessibility Mechanism\n\n\ud83d\udccc Research / Blog\n\ud83d\udc49https://www.mdsec.co.uk/2026/03/rip-regpwn/\n\n\ud83d\udccc GitHub (Exploit)\n\ud83d\udc49https://github.com/mdsecactivebreach/RegPwn\n\n\ud83d\udccc GitHub (BOF / Cobalt Strike)\n\ud83d\udc49https://github.com/Flangvik/RegPwnBOF\n\n\ud83d\udcd6 Description\nRegPwn is a Local Privilege Escalation (LPE) vulnerability in Windows\naffecting Windows 10, Windows 11, and multiple Windows Server versions.\n\nIt was discovered and used internally by MDSec during Red Team operations\nsince early 2025, and later patched in March 2026.\n\nTracked as:\n\ud83d\udc49 CVE-2026-24291\n\n\u2699\ufe0f Vulnerability Overview\nThe issue exists in the Windows Accessibility (ATBroker / ATConfig) mechanism.\nMisconfigured registry permissions\nUser-controlled registry data copied into privileged context\nWritable HKLM registry path exposed to low-priv users\n\ud83d\udc49 Leads to arbitrary registry write as SYSTEM\nAccording to CVE:\nIncorrect permission assignment allows local privilege escalation\n\n\ud83e\udde0 Exploitation Concept\nRegistry Flow Abuse\nHKCU (User Controlled)\n        \u2193\nHKLM Session Key (Writable)\n        \u2193\nHKU\\.DEFAULT (SYSTEM Context)\n        \u2193\nSYSTEM Process Execution\n\nCore Technique\n\u2022 Registry Symlink Abuse\n\u2022 Race Condition (Oplock)\n\u2022 Accessibility Feature Trigger (osk.exe)\n\ud83d\udc49 Result:\nLow Priv User \u2192 SYSTEM Privilege\n\n\u2694\ufe0f Exploit Details\nThe exploit abuses:\n\u2022 Accessibility configuration registry keys\n\u2022 Secure Desktop behavior\n\u2022 ATbroker.exe interaction\n\u2022 osk.exe execution timing\n\ud83d\udc49 By combining:\n\u2022 Opportunistic Lock (Oplock)\n\u2022 Registry Symbolic Link\nAn attacker can redirect writes to arbitrary SYSTEM registry locations\n\n\ud83d\udca3 Practical Impact\n\u2022 Local Privilege Escalation (LPE)\n\u2022 Full SYSTEM access\n\u2022 Service ImagePath hijacking\n\u2022 Payload execution as SYSTEM\n\n\ud83e\uddec GitHub \u2014 Exploit Implementation\n\u2699\ufe0f RegPwn (Original Exploit)\n\u2022 Language: C#\n\u2022 Targets:\n   \u2022 Windows 10 / 11\n   \u2022 Windows Server 2016 / 2019 / 2022\n   \u2022 Based on blog research\n\ud83d\udc49 Direct PoC for LPE\n\n\u2694\ufe0f RegPwnBOF (Cobalt Strike BOF)\n\u2022 BOF implementation of exploit\n\u2022 Designed for post-exploitation use\n\u2022 Supports:\nbeacon> regpwn payload.exe\n\ud83d\udc49 Enables SYSTEM escalation inside C2 operations\n\n\ud83e\udde0 Red Team Insight\nReal-World Usage Flow\nInitial Access\n     \u2193\nBeacon / Agent\n     \u2193\nRegPwn Execution\n     \u2193\nSYSTEM Privilege\n     \u2193\nLateral Movement / Persistence\n\nWhy This Matters\n\u2714\ufe0f Works on multiple Windows versions\n\u2714\ufe0f Reliable LPE vector\n\u2714\ufe0f BOF integration available\n\u2714\ufe0f Useful for post-exploitation chains\n\n\ud83d\ude80 Key Takeaways\n\u2022 Accessibility features can expose privileged pathways\n\u2022 Registry permission misconfig = critical attack surface\n\u2022 Race conditions + symlink = powerful LPE combo\n\u2022 Direct integration into C2 frameworks\n\n\u26a0\ufe0f Patch Status\n\u2714\ufe0f Fixed in March 2026 Patch Tuesday\n\u2714\ufe0f Affects pre-patch Windows environments\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:08.635506Z"}, {"uuid": "4cd7cf26-b9e8-468a-abec-4fb854c73f5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24291", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17069", "content": "\ud83d\udd25 Windows LPE Exploit \u2014 RegPwn (CVE-2026-24291)\n\u2694\ufe0f Registry Symlink Privilege Escalation via Accessibility Mechanism\n\n\ud83d\udccc Research / Blog\n\ud83d\udc49https://www.mdsec.co.uk/2026/03/rip-regpwn/\n\n\ud83d\udccc GitHub (Exploit)\n\ud83d\udc49https://github.com/mdsecactivebreach/RegPwn\n\n\ud83d\udccc GitHub (BOF / Cobalt Strike)\n\ud83d\udc49https://github.com/Flangvik/RegPwnBOF\n\n\ud83d\udcd6 Description\nRegPwn is a Local Privilege Escalation (LPE) vulnerability in Windows\naffecting Windows 10, Windows 11, and multiple Windows Server versions.\n\nIt was discovered and used internally by MDSec during Red Team operations\nsince early 2025, and later patched in March 2026.\n\nTracked as:\n\ud83d\udc49 CVE-2026-24291\n\n\u2699\ufe0f Vulnerability Overview\nThe issue exists in the Windows Accessibility (ATBroker / ATConfig) mechanism.\nMisconfigured registry permissions\nUser-controlled registry data copied into privileged context\nWritable HKLM registry path exposed to low-priv users\n\ud83d\udc49 Leads to arbitrary registry write as SYSTEM\nAccording to CVE:\nIncorrect permission assignment allows local privilege escalation\n\n\ud83e\udde0 Exploitation Concept\nRegistry Flow Abuse\nHKCU (User Controlled)\n        \u2193\nHKLM Session Key (Writable)\n        \u2193\nHKU\\.DEFAULT (SYSTEM Context)\n        \u2193\nSYSTEM Process Execution\n\nCore Technique\n\u2022 Registry Symlink Abuse\n\u2022 Race Condition (Oplock)\n\u2022 Accessibility Feature Trigger (osk.exe)\n\ud83d\udc49 Result:\nLow Priv User \u2192 SYSTEM Privilege\n\n\u2694\ufe0f Exploit Details\nThe exploit abuses:\n\u2022 Accessibility configuration registry keys\n\u2022 Secure Desktop behavior\n\u2022 ATbroker.exe interaction\n\u2022 osk.exe execution timing\n\ud83d\udc49 By combining:\n\u2022 Opportunistic Lock (Oplock)\n\u2022 Registry Symbolic Link\nAn attacker can redirect writes to arbitrary SYSTEM registry locations\n\n\ud83d\udca3 Practical Impact\n\u2022 Local Privilege Escalation (LPE)\n\u2022 Full SYSTEM access\n\u2022 Service ImagePath hijacking\n\u2022 Payload execution as SYSTEM\n\n\ud83e\uddec GitHub \u2014 Exploit Implementation\n\u2699\ufe0f RegPwn (Original Exploit)\n\u2022 Language: C#\n\u2022 Targets:\n   \u2022 Windows 10 / 11\n   \u2022 Windows Server 2016 / 2019 / 2022\n   \u2022 Based on blog research\n\ud83d\udc49 Direct PoC for LPE\n\n\u2694\ufe0f RegPwnBOF (Cobalt Strike BOF)\n\u2022 BOF implementation of exploit\n\u2022 Designed for post-exploitation use\n\u2022 Supports:\nbeacon> regpwn payload.exe\n\ud83d\udc49 Enables SYSTEM escalation inside C2 operations\n\n\ud83e\udde0 Red Team Insight\nReal-World Usage Flow\nInitial Access\n     \u2193\nBeacon / Agent\n     \u2193\nRegPwn Execution\n     \u2193\nSYSTEM Privilege\n     \u2193\nLateral Movement / Persistence\n\nWhy This Matters\n\u2714\ufe0f Works on multiple Windows versions\n\u2714\ufe0f Reliable LPE vector\n\u2714\ufe0f BOF integration available\n\u2714\ufe0f Useful for post-exploitation chains\n\n\ud83d\ude80 Key Takeaways\n\u2022 Accessibility features can expose privileged pathways\n\u2022 Registry permission misconfig = critical attack surface\n\u2022 Race conditions + symlink = powerful LPE combo\n\u2022 Direct integration into C2 frameworks\n\n\u26a0\ufe0f Patch Status\n\u2714\ufe0f Fixed in March 2026 Patch Tuesday\n\u2714\ufe0f Affects pre-patch Windows environments\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:07.358179Z"}]}