https://vulnerability.circl.lu/sightings/feed 2026-10-03T20:56:36.013514+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/6d919523-ab25-4dee-9bc5-c1f2efa2ec2e/export 2026-10-03T20:56:36.038404+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6d919523-ab25-4dee-9bc5-c1f2efa2ec2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/196473", "content": "Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)\nhttps://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/\n\n(1) An exposed IOCTL lets unprivileged users disable the x86 MONITOR (https://www.felixcloutier.com/x86/monitor) & MWAIT (https://www.felixcloutier.com/x86/mwait) instructions used by Hyper-V (https://en.wikipedia.org/wiki/Hyper-V) and other kernel components--triggering a HYPERVISOR_ERROR bugcheck. (2) Reaching the IOCTL requires exploiting a TOCTOU (https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use) bug arguably caused by poor documentation of the SeLocateProcessImageName (https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-selocateprocessimagename) function. (3) Reimplementation of the driver's security through obscurity IOCTL encryption scheme: SHA-256 KDF-derived XOR keystream & CRC16 Checksum. See full write-up (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/), and Github (https://github.com/connorjaydunn/CVE-2026-79417) for PoC. submitted by /u/p0xq (https://www.reddit.com/user/p0xq) \n [link] (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/) [comments] (https://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/)", "creation_timestamp": "2026-10-03T03:57:15.000000Z"} 2026-10-03T03:57:15+00:00 https://vulnerability.circl.lu/sighting/2dc2025e-f39c-4f09-96e4-6cb6107290ff/export 2026-10-03T20:56:36.040382+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "2dc2025e-f39c-4f09-96e4-6cb6107290ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "seen", "source": "https://t.me/hacking_Attack/196473", "content": "Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)\nhttps://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/\n\n(1) An exposed IOCTL lets unprivileged users disable the x86 MONITOR (https://www.felixcloutier.com/x86/monitor) & MWAIT (https://www.felixcloutier.com/x86/mwait) instructions used by Hyper-V (https://en.wikipedia.org/wiki/Hyper-V) and other kernel components--triggering a HYPERVISOR_ERROR bugcheck. (2) Reaching the IOCTL requires exploiting a TOCTOU (https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use) bug arguably caused by poor documentation of the SeLocateProcessImageName (https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-selocateprocessimagename) function. (3) Reimplementation of the driver's security through obscurity IOCTL encryption scheme: SHA-256 KDF-derived XOR keystream & CRC16 Checksum. See full write-up (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/), and Github (https://github.com/connorjaydunn/CVE-2026-79417) for PoC. submitted by /u/p0xq (https://www.reddit.com/user/p0xq) \n [link] (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/) [comments] (https://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/)", "creation_timestamp": "2026-10-03T03:57:15.000000Z"} 2026-10-03T03:57:15+00:00 https://vulnerability.circl.lu/sighting/0ca12f58-5f8c-4042-865d-1cad8c500673/export 2026-10-03T20:56:36.040532+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "0ca12f58-5f8c-4042-865d-1cad8c500673", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mwgmlt6s4m24", "content": "Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)", "creation_timestamp": "2026-09-26T15:39:32.005166Z"} 2026-09-26T15:39:32.005166+00:00 https://vulnerability.circl.lu/sighting/a800dc56-e4ef-4c1a-bc1e-fd61e5bdd1b6/export 2026-10-03T20:56:36.040647+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a800dc56-e4ef-4c1a-bc1e-fd61e5bdd1b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "published-proof-of-concept", "source": "Telegram/Yeumbd0afhQFKWhtQ_kYIVtV861DL6U2SRa0YhPEpV3GAh8", "content": "", "creation_timestamp": "2026-09-25T09:00:04.000000Z"} 2026-09-25T09:00:04+00:00 https://vulnerability.circl.lu/sighting/3ac171a3-f678-4bae-b940-af7c6e6bf15d/export 2026-10-03T20:56:36.040748+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3ac171a3-f678-4bae-b940-af7c6e6bf15d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "seen", "source": "Telegram/Yeumbd0afhQFKWhtQ_kYIVtV861DL6U2SRa0YhPEpV3GAh8", "content": "", "creation_timestamp": "2026-09-25T09:00:04.000000Z"} 2026-09-25T09:00:04+00:00 https://vulnerability.circl.lu/sighting/852e28f1-311c-441e-9f38-fa3a1df531d5/export 2026-10-03T20:56:36.040855+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "852e28f1-311c-441e-9f38-fa3a1df531d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "seen", "source": "https://gist.github.com/ichintu/cef2c12046d7246fbad5e72900e0d2df", "content": "Today\u2019s threat intelligence digest highlights four notable vulnerabilities:\n\n\u2022 **macOS TCC Bypass:** CDC/ACM serial interfaces can circumvent macOS Transparency, Consent, and Control (TCC) security restrictions, granting unauthorized access to protected resources. \n\u2022 **pfSense LFI (CVE-2026-97730, HIGH/8.5):** A flaw in dashboard widget sequence handling allows local file inclusion, enabling arbitrary PHP execution (requires authentication and dashboard modification privileges). \n\u2022 **Argus Monitor DoS (CVE-2026-79417):** A local IOCTL vulnerability exploits a TOCTOU race condition to disable x86 `MONITOR`/`MWAIT` instructions, triggering `HYPERVISOR_ERROR` bugchecks in Hyper-V and kernel components. \n\u2022 **Root Browser Classic Injection (CVE-2026-85082, HIGH/8.5):** Unsafe passing of SQLite database paths to the OS shell enables command injection due to improper filename/command separation. \n\nAll entries include technical write-ups, CVSS metrics, and proof-of-concept resources for further analysis.", "creation_timestamp": "2026-09-25T04:00:27.000000Z"} 2026-09-25T04:00:27+00:00 https://vulnerability.circl.lu/sighting/aebcaa63-0e2d-4b28-9ffb-878f604c126b/export 2026-10-03T20:56:36.040960+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "aebcaa63-0e2d-4b28-9ffb-878f604c126b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "seen", "source": "Telegram/RACfXFf4CCpOLZKZyR5Qndk-K5ZPYrCccXnDxmxSnxIfo6Q", "content": "", "creation_timestamp": "2026-09-25T03:00:11.000000Z"} 2026-09-25T03:00:11+00:00 https://vulnerability.circl.lu/sighting/217e9bb3-5816-490b-8031-6fc212368e20/export 2026-10-03T20:56:36.041053+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "217e9bb3-5816-490b-8031-6fc212368e20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "published-proof-of-concept", "source": "Telegram/RACfXFf4CCpOLZKZyR5Qndk-K5ZPYrCccXnDxmxSnxIfo6Q", "content": "", "creation_timestamp": "2026-09-25T03:00:11.000000Z"} 2026-09-25T03:00:11+00:00 https://vulnerability.circl.lu/sighting/8ea6b1a5-4a92-4af5-b8e9-71a69a167095/export 2026-10-03T20:56:36.041154+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8ea6b1a5-4a92-4af5-b8e9-71a69a167095", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mwcpvuzguu2q", "content": "Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)", "creation_timestamp": "2026-09-25T02:28:12.948466Z"} 2026-09-25T02:28:12.948466+00:00 https://vulnerability.circl.lu/sighting/2eceeb02-fd9d-43aa-b533-450f989851ce/export 2026-10-03T20:56:36.041251+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "2eceeb02-fd9d-43aa-b533-450f989851ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103286", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-79417\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a connorjaydunn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 01:03:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-79417 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T02:00:08.000000Z"} 2026-09-25T02:00:08+00:00