12 minhigh
Exploits and vulnerabilities in Q2 2026
Q2 2026 saw a record surge in registered CVEs driven by AI-assisted vulnerability research, with entire new vulnerability classes discovered in the Linux kernel caching subsystem (Dirty Frag family). A researcher published working exploits for six unpatched Windows vulnerabilities before CVE assignment, including multiple Windows Defender privilege escalation flaws and a BitLocker bypass. APT groups rapidly adopted newly disclosed vulnerabilities and began targeting AI infrastructure. AI tools themselves accumulated significant vulnerability counts, with critical issues in OpenClaw (credential theft via WebSocket), Dify (tenant isolation bypass), and Open WebUI (broken access control).
Sens:▲ 24hConf:
Showing defanged values
- cveCVE-2017-0199Vulnerability allowing attacker to gain control over the system.
- cveCVE-2017-11882Remote code execution vulnerability in the Equation Editor component.
- cveCVE-2018-0802Remote code execution vulnerability in the Equation Editor component.
- cveCVE-2019-13272Privilege escalation via improper handling of privilege inheritance.
- cveCVE-2021-22555Heap out-of-bounds write vulnerability in the Netfilter kernel subsystem.
- cveCVE-2022-0847Privilege escalation and hijacking of running applications via pipe buffer manipulation.
- cveCVE-2023-32233Use-after-free vulnerability allowing privilege escalation through improper processing of network requests.
- cveCVE-2023-36884Vulnerability allowing commands to run on the system, bypassing the mark-of-the-web (MoTW) mechanism.
- cveCVE-2023-38831Improper handling of objects within an archive allowing exploitation for initial access.
- cveCVE-2023-46604Insecure deserialization vulnerability allowing arbitrary code execution in the context of the service process.
- cveCVE-2024-12356Command injection vulnerability allowing attacker to send malicious commands without system authentication.
- cveCVE-2025-53770Insecure deserialization vulnerability allowing unauthenticated command execution on the server.
- cveCVE-2025-6218Directory traversal vulnerability allowing extraction of files into arbitrary directories, potentially leading to malicious command execution.
- cveCVE-2025-8088Directory traversal vulnerability using NTFS Streams to circumvent directory controls during archive extraction.
- cveCVE-2026-1731Command injection vulnerability allowing attacker to send malicious commands without system authentication.
- cveCVE-2026-25253gatewayUrl vulnerability where UI trusts attacker-controlled URL parameter, auto-connects via WebSocket, and sends authentication token without user confirmation.
- cveCVE-2026-31431Local privilege escalation via page cache modification allowing unprivileged user to gain root, dangerous for cloud and containerized environments.
- cveCVE-2026-31635DirtyDecrypt vulnerability allowing local attacker to escalate privileges via improper handling of decryption operations and page cache data modification.
- cveCVE-2026-35273Server-side request forgery vulnerability exploited in APT attacks.
- cveCVE-2026-41948Path traversal vulnerability allowing authenticated user to escape tenant isolation and access internal REST APIs.
- cveCVE-2026-43284Dirty Frag family vulnerability allowing local user to overwrite page cache and escalate privileges to root.
- cveCVE-2026-43494PinTheft vulnerability allowing local user to gain elevated privileges due to errors in memory page pinning.
- cveCVE-2026-43500Dirty Frag family vulnerability allowing local user to overwrite page cache and escalate privileges to root.
- cveCVE-2026-45386Improper access control allowing read-only users to modify message pinned status by only checking read permission for write operations.
- cveCVE-2026-45501Improper neutralization of user input when generating Exchange web pages, potentially leading to spoofing and content manipulation.
- cveCVE-2026-46300Fragnesia vulnerability allowing unprivileged user to gain root via page cache modification through packet fragment handling.
- cveCVE-2026-46331pedit COW vulnerability exploiting copy-on-write flaw to modify page cache and escalate privileges to root.
- filenamewermgr.exeWindows system file targeted for overwrite by the RougePlanet Windows Defender TOCTOU exploit. Attacker replaces this file with a malicious version.
Detection / Hunteropenrouter
What Happened
In the second quarter of 2026, a record number of software security flaws were discovered, largely because AI tools are now being used to find vulnerabilities at scale. A security researcher published working attack code for six unpatched Windows flaws before Microsoft had even assigned official vulnerability identifiers, including ways to bypass disk encryption and disable antivirus. A new family of Linux kernel flaws called Dirty Frag allows attackers to gain full control of systems, which is especially dangerous for cloud servers. Organizations using AI tools like OpenClaw, Dify, or Open WebUI should audit these for known security issues, as attackers are beginning to target AI infrastructure directly. The main action is to patch systems quickly, disable vulnerable Linux kernel modules where patching is not possible, and apply extra scrutiny to AI-related tools in production environments.
Key Takeaways
- Researchers are publishing working exploits for unpatched Windows vulnerabilities before CVE assignment, giving attackers a head start over vendors
- The Dirty Frag family of Linux kernel vulnerabilities in the caching subsystem enables reliable local privilege escalation across cloud and containerized environments
- AI and LLM tools (OpenClaw, Dify, Open WebUI) are accumulating significant vulnerability counts, with issues including credential theft via WebSocket, path traversal, and broken access control
- APT groups are rapidly adopting newly published vulnerabilities and targeting AI infrastructure such as Langflow, expanding the attack surface beyond traditional enterprise software
- Fake AI-generated vulnerability research targeting Exchange and SharePoint was observed, designed to mislead researchers and delay detection of real vulnerabilities
Affected Systems
- Windows Defender (signature update engine, real-time scanning engine, service)
- Windows BitLocker / Windows Recovery Environment (WinRE)
- Windows CTFMON (Collaborative Translation Framework) service
- Linux kernel (caching subsystem, networking subsystem - IPsec ESP, RxRPC, traffic control)
- WinRAR
- Microsoft Equation Editor
- Microsoft Office and WordPad
- Microsoft SharePoint
- Microsoft Exchange
- Oracle PeopleSoft PeopleTools
- Apache ActiveMQ
- BeyondTrust software
- OpenClaw AI platform
- Dify AI platform
- Open WebUI
- Langflow
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-31431 | Linux kernel (caching subsystem) | High | Local privilege escalation via page cache modification allowing unprivileged user to gain root, dangerous for cloud and containerized environments. |
| CVE-2026-43284 | Linux kernel (IPsec ESP networking subsystem) | High | Dirty Frag family vulnerability allowing local user to overwrite page cache and escalate privileges to root. |
| CVE-2026-43500 | Linux kernel (RxRPC networking subsystem) | High | Dirty Frag family vulnerability allowing local user to overwrite page cache and escalate privileges to root. |
| CVE-2026-46300 | Linux kernel (packet fragment handling) | High | Fragnesia vulnerability allowing unprivileged user to gain root via page cache modification through packet fragment handling. |
| CVE-2026-31635 | Linux kernel (decryption operations) | High | DirtyDecrypt vulnerability allowing local attacker to escalate privileges via improper handling of decryption operations and page cache data modification. |
| CVE-2026-43494 | Linux kernel (memory page pinning mechanism) | High | PinTheft vulnerability allowing local user to gain elevated privileges due to errors in memory page pinning. |
| CVE-2026-46331 | Linux kernel (traffic control subsystem - tc-pedit) | High | pedit COW vulnerability exploiting copy-on-write flaw to modify page cache and escalate privileges to root. |
| CVE-2026-25253 | OpenClaw AI platform | High | gatewayUrl vulnerability where UI trusts attacker-controlled URL parameter, auto-connects via WebSocket, and sends authentication token without user confirmation. |
| CVE-2026-41948 | Dify AI platform | High | Path traversal vulnerability allowing authenticated user to escape tenant isolation and access internal REST APIs. |
| CVE-2026-45386 | Open WebUI | Medium | Improper access control allowing read-only users to modify message pinned status by only checking read permission for write operations. |
| CVE-2026-45501 | Microsoft Exchange | Medium | Improper neutralization of user input when generating Exchange web pages, potentially leading to spoofing and content manipulation. |
| CVE-2026-35273 | Oracle PeopleSoft PeopleTools | High | Server-side request forgery vulnerability exploited in APT attacks. |
| CVE-2023-46604 | Apache ActiveMQ | Critical | Insecure deserialization vulnerability allowing arbitrary code execution in the context of the service process. |
| CVE-2024-12356 | BeyondTrust software | High | Command injection vulnerability allowing attacker to send malicious commands without system authentication. |
| CVE-2026-1731 | BeyondTrust software | High | Command injection vulnerability allowing attacker to send malicious commands without system authentication. |
| CVE-2023-36884 | Windows Search | High | Vulnerability allowing commands to run on the system, bypassing the mark-of-the-web (MoTW) mechanism. |
| CVE-2025-53770 | Microsoft SharePoint | Critical | Insecure deserialization vulnerability allowing unauthenticated command execution on the server. |
| CVE-2025-6218 | WinRAR | High | Directory traversal vulnerability allowing extraction of files into arbitrary directories, potentially leading to malicious command execution. |
| CVE-2025-8088 | WinRAR | High | Directory traversal vulnerability using NTFS Streams to circumvent directory controls during archive extraction. |
| CVE-2023-38831 | WinRAR | High | Improper handling of objects within an archive allowing exploitation for initial access. |
| CVE-2018-0802 | Microsoft Equation Editor | Critical | Remote code execution vulnerability in the Equation Editor component. |
| CVE-2017-11882 | Microsoft Equation Editor | Critical | Remote code execution vulnerability in the Equation Editor component. |
| CVE-2017-0199 | Microsoft Office and WordPad | Critical | Vulnerability allowing attacker to gain control over the system. |
| CVE-2022-0847 | Linux kernel (Dirty Pipe) | High | Privilege escalation and hijacking of running applications via pipe buffer manipulation. |
| CVE-2019-13272 | Linux kernel | High | Privilege escalation via improper handling of privilege inheritance. |
| CVE-2021-22555 | Linux kernel (Netfilter) | High | Heap out-of-bounds write vulnerability in the Netfilter kernel subsystem. |
| CVE-2023-32233 | Linux kernel (Netfilter) | High | Use-after-free vulnerability allowing privilege escalation through improper processing of network requests. |
Attack Chain
- Initial Access: Attackers exploit newly published vulnerabilities (WinRAR directory traversal, SharePoint deserialization, Windows Search MoTW bypass) or leverage weaponized documents targeting Equation Editor vulnerabilities
- Privilege Escalation: Local exploits deployed against Linux kernel caching subsystem (Dirty Frag family) or Windows Defender TOCTOU race conditions to gain elevated privileges
- Defense Evasion: Windows Defender vulnerabilities (RedSun, UnDefend) used to overwrite malicious file detections or block antivirus updates
- Persistence: RougePlanet exploit overwrites wermgr.exe with malicious version via Windows Defender real-time scanning TOCTOU
- C2 Establishment: C2 agents deployed via frameworks such as Sliver, Havoc, AdaptixC2, or Metasploit using initial access vulnerabilities
- AI Infrastructure Targeting: APT groups exploit AI platform vulnerabilities (OpenClaw gatewayUrl, Dify path traversal) to steal credentials, bypass tenant isolation, or compromise agent hosts
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not contain detection rules. It is a quarterly vulnerability landscape report with statistical data and vulnerability descriptions.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect exploitation attempts of Windows Defender vulnerabilities through process behavior monitoring and file overwrite events. Linux kernel privilege escalation via page cache manipulation may produce limited EDR telemetry depending on the agent's kernel-level visibility. |
| Network Visibility | Low | Most described vulnerabilities are local privilege escalation or client-side exploitation. Network visibility would primarily apply to exploitation of server-side vulnerabilities like SharePoint deserialization or PeopleSoft SSRF, but the article does not provide network IOCs. |
| Detection Difficulty | Hard | The Windows Defender TOCTOU exploits involve race conditions that are difficult to detect in real time. Linux kernel page cache manipulation occurs at a layer where most monitoring tools have limited visibility. AI platform vulnerabilities require application-level logging that many organizations have not yet deployed. |
Required Log Sources
- Windows Event Log (Sysmon Event ID 1, 7, 11, 13)
- Linux audit logs (auditd)
- Linux kernel ring buffer (dmesg)
- EDR process telemetry
- Web server access logs for SharePoint/Exchange/PeopleSoft
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for unexpected file modifications to wermgr.exe or other system binaries that coincide with Windows Defender signature update activity, which could indicate exploitation of the RougePlanet or BlueHammer TOCTOU vulnerabilities. | Sysmon Event ID 7 (image loaded), Event ID 11 (file create), EDR file modification telemetry | Persistence / Privilege Escalation | Medium - legitimate Windows updates may modify system binaries, requiring correlation with Defender update timing |
| Consider hunting for Linux processes that unexpectedly gain root privileges shortly after network-related kernel activity, which could indicate Dirty Frag family exploitation via IPsec ESP, RxRPC, or traffic control subsystems. | auditd privilege escalation events, Linux kernel audit logs, process ancestry data | Privilege Escalation | Low to Medium - legitimate privilege changes are typically well-documented in enterprise environments |
| Consider hunting for WebSocket connections from OpenClaw instances to unexpected external addresses, which could indicate exploitation of CVE-2026-25253 where the gatewayUrl parameter redirects connections to attacker-controlled endpoints. | Network proxy logs, endpoint network connection telemetry, DNS resolution logs | Initial Access / Credential Access | Low - WebSocket connections to non-standard destinations from AI platforms warrant investigation |
| Consider hunting for authenticated requests to Dify AI platform that access internal REST API paths outside expected tenant boundaries, which could indicate exploitation of CVE-2026-41948 path traversal. | Web application firewall logs, Dify application access logs, reverse proxy logs | Privilege Escalation / Lateral Movement | Low - cross-tenant API access is typically anomalous |
| Consider hunting for WinRAR archive extraction events that write files to unexpected directories or use NTFS alternate data streams, which could indicate exploitation of CVE-2025-6218 or CVE-2025-8088. | EDR file write telemetry, Sysmon Event ID 11, process command line logging | Initial Access | Medium - legitimate archive extraction may produce similar file write patterns |
Control Gaps
- Signature-based antivirus may not detect exploitation of Windows Defender itself, as the security product is the target
- Network-based detection cannot observe local privilege escalation via Linux kernel page cache manipulation
- AI platform vulnerabilities may bypass traditional web application firewalls that do not understand WebSocket or AI agent communication patterns
- Race condition exploits (TOCTOU) operate within timing windows too narrow for most real-time detection mechanisms
- Fake AI-generated vulnerability research could mislead security teams into deploying incorrect detection logic or wasting analyst time
Key Behavioral Indicators
- Modification of wermgr.exe during Windows Defender real-time scanning or signature update operations
- Windows Defender service stopping or failing to update signatures, potentially indicating UnDefend exploitation
- Linux processes transitioning to root privileges without corresponding sudo or su activity in audit logs
- WebSocket connections initiated by AI agent processes to non-standard external endpoints
- WinRAR process writing files to system directories or using NTFS alternate data streams during extraction
- BitLocker status changes or WinRE access attempts outside of legitimate administrative workflows
False Positive Assessment
Medium - Detection of Windows Defender TOCTOU exploitation requires distinguishing legitimate signature update file operations from malicious ones. Linux kernel privilege escalation detection may produce false positives from legitimate administrative privilege changes. AI platform anomaly detection is a new domain with limited baseline data for many organizations.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider prioritizing patches for Linux kernel vulnerabilities in the Dirty Frag family, especially on cloud and containerized hosts where page cache manipulation enables container escape.
- Evaluate whether disabling vulnerable Linux kernel modules (IPsec ESP, RxRPC, tc-pedit) is feasible in your environment if patching is not yet available.
- Consider reviewing whether Windows Defender signature update directories and real-time scanning paths have appropriate ACLs to prevent TOCTOU exploitation by non-privileged users.
- If your organization uses OpenClaw, Dify, or Open WebUI, consider auditing deployed versions against the described CVEs and restricting external WebSocket connections from AI agent processes.
Infrastructure Hardening
- Consider implementing network segmentation to isolate AI tool infrastructure from production systems, limiting the blast radius of AI platform compromises.
- Evaluate whether your web application firewall can inspect and block WebSocket connections to non-whitelisted destinations from AI agent platforms.
- Consider deploying kernel-level monitoring on Linux servers in cloud environments to detect page cache manipulation attempts.
- Review whether BitLocker pre-boot authentication and WinRE access policies are sufficient to prevent the YellowKey bypass technique.
User Protection
- Consider deploying endpoint detection that monitors for WinRAR extraction to unexpected paths, particularly system directories and paths involving NTFS alternate data streams.
- Evaluate whether your email security stack blocks or quarantines documents exploiting Equation Editor vulnerabilities (CVE-2018-0802, CVE-2017-11882), as these remain actively exploited.
- Consider restricting WinRAR usage or deploying an alternative archiver if patches for CVE-2025-6218 and CVE-2025-8088 cannot be applied promptly.
Security Awareness
- Consider briefing security analysts on the emergence of fake AI-generated vulnerability research targeting Exchange and SharePoint, and establish verification procedures for published exploit code before acting on it.
- Consider training development teams on the security risks of AI-generated code, emphasizing that code quality and security validation remain necessary even when using AI development tools.
- Consider incorporating AI tool security into existing security awareness programs, covering credential handling and sensitive data exposure in systems that use LLM agents.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping7 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Tactic
Lateral Movement
Tactic
Impact
Additional IOCs
- File Paths:
wermgr.exe- Windows system file targeted for overwrite by the RougePlanet Windows Defender TOCTOU exploit. Attacker replaces this file with a malicious version.