Loading story…
Public exploit monitoring feeds highlighted two newly listed elevation-of-privilege vulnerabilities: CVE-2026-26167 affecting Windows Push Notifications and CVE-2026-4145 affecting Lenovo Software Fix. Both entries were published through high-severity CVE tracking and tied to GitHub-based monitoring intended to identify newly public proof-of-concept repositories and exploit code.
The available details indicate the monitoring process scans GitHub for public exploit and PoC repositories, sorts matches by most recently updated, and limits output to the first 15 repositories for performance reasons. No threat actor, malware family, victim organization, exploitation evidence, or technical exploit details were provided in the referenced material, but the appearance of these CVEs in PoC-tracking feeds suggests defenders should watch for emerging exploit code and prioritize validation of exposure to the affected Windows and Lenovo components.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public GitHub repositories were flagged for newly published proof-of-concept exploits tied to two high-severity vulnerabilities: **`CVE-2026-34177`**, a VM low-level restriction bypass involving `raw.apparmor` and `raw.qemu.conf`, and **`CVE-2025-7389`**, an unauthorized arbitrary file-read issue via RMI in an AdminServer interface. The monitoring identified repositories advertising exploit code or demonstrations for both flaws, indicating that offensive tradecraft is now publicly accessible. The referenced tracking activity monitors GitHub for exploit and PoC publications, ranks results by most recently updated repositories, and limits visible results to the first 15 entries for performance reasons. For defenders, the appearance of public exploit material raises the urgency of validating exposure to affected virtualization and AdminServer deployments, prioritizing patching or mitigations, and increasing detection coverage for exploitation attempts targeting these CVEs.
Jul 12, 2026
Microsoft published security advisories for several **elevation-of-privilege** vulnerabilities affecting Windows components and related software, including **Microsoft PC Manager** (`CVE-2025-21322`), **Windows Installer** (`CVE-2025-21331`, `CVE-2025-21373`), **Visual Studio** (`CVE-2025-49739`), **.NET** (`CVE-2025-55247`), **Windows Health and Optimized Experiences** (`CVE-2025-59241`), and **Host Process for Windows Tasks** (`CVE-2025-60710`). Microsoft also lists an earlier **Windows Storage** privilege-escalation issue, `CVE-2023-36399`, in its security guidance portal. The advisories provide limited public detail beyond product names and vulnerability class, but the grouping indicates broad exposure across both endpoint and developer environments where successful exploitation could allow an attacker to gain higher privileges on a target system. Organizations using affected Microsoft software should review the corresponding Security Update Guide entries, prioritize patch validation for Windows and developer-tooling assets, and assess whether privilege-escalation paths could be chained with other flaws or post-compromise activity.
Jul 12, 2026
A public proof-of-concept exploit has been released for **CVE-2026-42980**, a high-severity Windows NT OS Kernel elevation-of-privilege flaw that allows a locally authenticated low-privileged user to gain **`NT AUTHORITY\SYSTEM`** access. The vulnerability stems from an integer underflow in the kernel's WMI serialization code that can trigger a heap-based buffer overflow and kernel memory corruption on supported Windows client and server releases, including Windows 10 Version 1607 and later builds. Microsoft patched the issue in its June 2026 Patch Tuesday updates, assigned it a **CVSS 3.1 score of `7.8`**, and assessed exploitation as **"more likely."** While there is no confirmed in-the-wild exploitation reported so far, the availability of exploit code raises the risk that attackers could use the bug after initial compromise to obtain full machine control, particularly on shared systems and servers. Microsoft has not provided a configuration workaround, making prompt deployment and validation of the June 2026 cumulative updates the primary mitigation.
Jul 23, 2026