{"vulnerability": "CVE-2026-79417", "sightings": [{"uuid": "8ea6b1a5-4a92-4af5-b8e9-71a69a167095", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mwcpvuzguu2q", "content": "Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)", "creation_timestamp": "2026-09-25T02:28:12.948466Z"}, {"uuid": "852e28f1-311c-441e-9f38-fa3a1df531d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "seen", "source": "https://gist.github.com/ichintu/cef2c12046d7246fbad5e72900e0d2df", "content": "Today\u2019s threat intelligence digest highlights four notable vulnerabilities:\n\n\u2022 **macOS TCC Bypass:** CDC/ACM serial interfaces can circumvent macOS Transparency, Consent, and Control (TCC) security restrictions, granting unauthorized access to protected resources.  \n\u2022 **pfSense LFI (CVE-2026-97730, HIGH/8.5):** A flaw in dashboard widget sequence handling allows local file inclusion, enabling arbitrary PHP execution (requires authentication and dashboard modification privileges).  \n\u2022 **Argus Monitor DoS (CVE-2026-79417):** A local IOCTL vulnerability exploits a TOCTOU race condition to disable x86 `MONITOR`/`MWAIT` instructions, triggering `HYPERVISOR_ERROR` bugchecks in Hyper-V and kernel components.  \n\u2022 **Root Browser Classic Injection (CVE-2026-85082, HIGH/8.5):** Unsafe passing of SQLite database paths to the OS shell enables command injection due to improper filename/command separation.  \n\nAll entries include technical write-ups, CVSS metrics, and proof-of-concept resources for further analysis.", "creation_timestamp": "2026-09-25T04:00:27.000000Z"}, {"uuid": "fb46b3a0-6fba-4a12-82d4-e9c031aef217", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "seen", "source": "https://t.me/GithubRedTeam/103286", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-79417\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a connorjaydunn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 01:03:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-79417 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T02:00:08.000000Z"}, {"uuid": "2eceeb02-fd9d-43aa-b533-450f989851ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103286", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-79417\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a connorjaydunn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 01:03:12\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-79417 PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T02:00:08.000000Z"}, {"uuid": "3ac171a3-f678-4bae-b940-af7c6e6bf15d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "seen", "source": "Telegram/Yeumbd0afhQFKWhtQ_kYIVtV861DL6U2SRa0YhPEpV3GAh8", "content": "", "creation_timestamp": "2026-09-25T09:00:04.000000Z"}, {"uuid": "aebcaa63-0e2d-4b28-9ffb-878f604c126b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "seen", "source": "Telegram/RACfXFf4CCpOLZKZyR5Qndk-K5ZPYrCccXnDxmxSnxIfo6Q", "content": "", "creation_timestamp": "2026-09-25T03:00:11.000000Z"}, {"uuid": "a800dc56-e4ef-4c1a-bc1e-fd61e5bdd1b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "published-proof-of-concept", "source": "Telegram/Yeumbd0afhQFKWhtQ_kYIVtV861DL6U2SRa0YhPEpV3GAh8", "content": "", "creation_timestamp": "2026-09-25T09:00:04.000000Z"}, {"uuid": "217e9bb3-5816-490b-8031-6fc212368e20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "published-proof-of-concept", "source": "Telegram/RACfXFf4CCpOLZKZyR5Qndk-K5ZPYrCccXnDxmxSnxIfo6Q", "content": "", "creation_timestamp": "2026-09-25T03:00:11.000000Z"}, {"uuid": "0ca12f58-5f8c-4042-865d-1cad8c500673", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mwgmlt6s4m24", "content": "Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)", "creation_timestamp": "2026-09-26T15:39:32.005166Z"}, {"uuid": "2dc2025e-f39c-4f09-96e4-6cb6107290ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "seen", "source": "https://t.me/hacking_Attack/196473", "content": "Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)\nhttps://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/\n\n(1) An exposed IOCTL lets unprivileged users disable the x86 MONITOR (https://www.felixcloutier.com/x86/monitor) & MWAIT (https://www.felixcloutier.com/x86/mwait) instructions used by Hyper-V (https://en.wikipedia.org/wiki/Hyper-V) and other kernel components--triggering a HYPERVISOR_ERROR bugcheck. (2) Reaching the IOCTL requires exploiting a TOCTOU (https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use) bug arguably caused by poor documentation of the SeLocateProcessImageName (https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-selocateprocessimagename) function. (3) Reimplementation of the driver's security through obscurity IOCTL encryption scheme: SHA-256 KDF-derived XOR keystream & CRC16 Checksum. See full write-up (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/), and Github (https://github.com/connorjaydunn/CVE-2026-79417) for PoC.    submitted by    /u/p0xq  (https://www.reddit.com/user/p0xq) \n [link] (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/)   [comments] (https://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/)", "creation_timestamp": "2026-10-03T03:57:15.000000Z"}, {"uuid": "6d919523-ab25-4dee-9bc5-c1f2efa2ec2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79417", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/196473", "content": "Argus Monitor Local Denial-of-Service Vulnerability (CVE-2026-79417)\nhttps://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/\n\n(1) An exposed IOCTL lets unprivileged users disable the x86 MONITOR (https://www.felixcloutier.com/x86/monitor) & MWAIT (https://www.felixcloutier.com/x86/mwait) instructions used by Hyper-V (https://en.wikipedia.org/wiki/Hyper-V) and other kernel components--triggering a HYPERVISOR_ERROR bugcheck. (2) Reaching the IOCTL requires exploiting a TOCTOU (https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use) bug arguably caused by poor documentation of the SeLocateProcessImageName (https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-selocateprocessimagename) function. (3) Reimplementation of the driver's security through obscurity IOCTL encryption scheme: SHA-256 KDF-derived XOR keystream & CRC16 Checksum. See full write-up (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/), and Github (https://github.com/connorjaydunn/CVE-2026-79417) for PoC.    submitted by    /u/p0xq  (https://www.reddit.com/user/p0xq) \n [link] (https://connorjaydunn.github.io/blog/posts/argus-monitor-ldos-cve-2026-79417/)   [comments] (https://www.reddit.com/r/redteamsec/comments/1wpwggq/argus_monitor_local_denialofservice_vulnerability/)", "creation_timestamp": "2026-10-03T03:57:15.000000Z"}]}