Loading story…
Kaspersky disclosed PhantomRPC, a Windows RPC architectural weakness that can let a low-privileged local attacker escalate to SYSTEM or Administrator by standing up a fake RPC server when the legitimate server is unavailable. The flaw affects RPC client-server interactions over ALPC and named pipes, where a privileged client can connect to an attacker-controlled endpoint exposing the same interface and endpoint; if the attacker already has a service account with SeImpersonatePrivilege, such as Network Service or Local Service, they can call RpcImpersonateClient and assume the identity of the higher-privileged client. Researchers said the behavior stems from rpcrt4.dll accepting responses from spoofed servers under these failure conditions and described it as an architectural issue affecting potentially all Windows versions.
The research detailed five exploitation paths, including coercing the Group Policy service through a fake TermService endpoint, waiting for Microsoft Edge or WdiSystemHost to contact TermService, abusing ipconfig.exe when the DHCP Client service is disabled, and abusing w32tm.exe through a nonexistent W32Time pipe. Proof-of-concept testing was reported on Windows Server 2022 and Windows Server 2025. Microsoft was notified in 2025 but classified the issue as moderate severity, assigned no CVE, and did not plan an immediate patch. Kaspersky recommended ETW-based monitoring for RPC_S_SERVER_UNAVAILABLE failures, reducing unnecessary SeImpersonatePrivilege, enabling disabled services where practical, and using released GitHub assessment tools to identify exposed RPC client-server mismatches.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Kaspersky disclosed PhantomRPC at Black Hat Asia 2026, presenting the vulnerability as a local privilege-escalation technique affecting potentially all Windows versions. The presentation highlighted five exploitation paths and shared mitigation guidance and assessment tools.
Securelist published research describing PhantomRPC as an architectural weakness in Windows RPC that can let a low-privileged attacker-controlled fake RPC server impersonate privileged clients and escalate to SYSTEM or administrator. The disclosure said the issue affects all Windows versions, documented five exploitation paths, and described an ETW-based detection methodology.
Kaspersky researchers reported the PhantomRPC Windows RPC privilege-escalation issue to Microsoft in September 2025. Microsoft later classified the issue as moderate severity, did not assign a CVE, and did not plan an immediate patch.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcecybersecuritynews.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Securelist disclosed **PhantomRPC**, a privilege escalation vulnerability affecting Remote Procedure Call (**RPC**) mechanisms, warning that the flaw could allow an attacker with limited access to elevate privileges on a targeted system. The report identifies the issue as a security weakness in RPC handling and frames it as a significant post-compromise risk because privilege escalation can turn a constrained foothold into broader control over an affected host. The disclosure highlights the vulnerability as an important defensive concern for organizations that rely on RPC-enabled services and administrative workflows. Security teams are likely to assess exposure, review vendor guidance and patches if available, and prioritize detection for suspicious privilege changes or abuse of RPC-related processes while evaluating whether the flaw could be chained with other access vectors.
Jun 29, 2026
Microsoft released fixes for **critical remote code execution vulnerabilities** in the Windows RPC Runtime, including **`CVE-2022-26809`**, a flaw in `rpcrt4.dll` that could allow **unauthenticated, zero-click code execution** on vulnerable systems. Security reporting said the bug stemmed from an integer overflow that could lead to a heap buffer overflow during RPC processing, affecting both client-side and server-side code paths in Windows. Researchers warned that unpatched systems exposing **TCP port `445`** were at particular risk, with internet scanning indicating that **more than 700,000** Windows machines could be reachable and potentially vulnerable. Microsoft’s April security updates addressed the issue, while defenders were urged to **apply patches**, **block external access to port `445`**, and **restrict inbound connections** to reduce exposure.
Aug 6, 2026
Multiple public write-ups detailed how Windows service and RPC design flaws enabled **local privilege escalation**, **sandbox escape**, and in some cases reliable code execution. Research on the Windows SSDP service linked `FC_BINDING_CONTEXT` misuse to **CVE-2025-48815**, showing that a context handle from one RPC interface could be passed into another interface expecting a different type and ultimately abused to call `CloseHandle` on an unintended handle. Separate analysis of the Windows telephony service described **CVE-2024-26230** as a use-after-free in `tapisrv` caused by improper ownership validation of RPC-managed objects, allowing a dangling pointer to be reclaimed with attacker-controlled data and steered toward `LoadLibraryW` despite **XFG** protections. Earlier Windows RPC research also covered Storage Service bugs **CVE-2019-0983** and **CVE-2019-0998**, where file-copy, directory, and ACL logic exposed through RPC could be abused to overwrite privileged files or alter their security descriptors. Other disclosures showed the same pattern across Windows subsystems. Analysis of **CVE-2022-22715** in `npfs.sys` demonstrated that malformed `LOCAL\` named pipe paths could trigger integer overflow and out-of-bounds kernel writes, enabling escape from the Adobe Reader **AppContainer** sandbox and escalation to kernel read/write. Research into **CVE-2021-1648** in `splwow64` described bypasses in printer-handle validation and an arbitrary address read, while older work on **CVE-2018-8550** examined COM `DfMarshal` abuse for elevation of privilege through privileged unmarshaling paths. Related reporting also highlighted Microsoft hard-link mitigations and a Citrix restricted-desktop breakout that relied on allowed scripting components rather than a zero-day, underscoring how weak validation, unsafe object handling, and incomplete execution controls repeatedly exposed high-impact privilege boundaries on Windows.
Aug 3, 2026