Loading story…
Securelist disclosed PhantomRPC, a privilege escalation vulnerability affecting Remote Procedure Call (RPC) mechanisms, warning that the flaw could allow an attacker with limited access to elevate privileges on a targeted system. The report identifies the issue as a security weakness in RPC handling and frames it as a significant post-compromise risk because privilege escalation can turn a constrained foothold into broader control over an affected host.
The disclosure highlights the vulnerability as an important defensive concern for organizations that rely on RPC-enabled services and administrative workflows. Security teams are likely to assess exposure, review vendor guidance and patches if available, and prioritize detection for suspicious privilege changes or abuse of RPC-related processes while evaluating whether the flaw could be chained with other access vectors.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published a disclosure about PhantomRPC, describing it as a privilege escalation vulnerability affecting RPC. No additional dated milestones or remediation events are provided in the reference content.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky disclosed **PhantomRPC**, a Windows RPC architectural weakness that can let a low-privileged local attacker escalate to **SYSTEM** or **Administrator** by standing up a fake RPC server when the legitimate server is unavailable. The flaw affects RPC client-server interactions over **ALPC** and named pipes, where a privileged client can connect to an attacker-controlled endpoint exposing the same interface and endpoint; if the attacker already has a service account with `SeImpersonatePrivilege`, such as **Network Service** or **Local Service**, they can call `RpcImpersonateClient` and assume the identity of the higher-privileged client. Researchers said the behavior stems from `rpcrt4.dll` accepting responses from spoofed servers under these failure conditions and described it as an architectural issue affecting potentially all Windows versions. The research detailed five exploitation paths, including coercing the **Group Policy** service through a fake **TermService** endpoint, waiting for **Microsoft Edge** or **WdiSystemHost** to contact TermService, abusing `ipconfig.exe` when the **DHCP Client** service is disabled, and abusing `w32tm.exe` through a nonexistent **W32Time** pipe. Proof-of-concept testing was reported on **Windows Server 2022** and **Windows Server 2025**. Microsoft was notified in 2025 but classified the issue as moderate severity, assigned no **CVE**, and did not plan an immediate patch. Kaspersky recommended **ETW-based** monitoring for `RPC_S_SERVER_UNAVAILABLE` failures, reducing unnecessary `SeImpersonatePrivilege`, enabling disabled services where practical, and using released GitHub assessment tools to identify exposed RPC client-server mismatches.
Jun 29, 2026
Microsoft disclosed **CVE-2026-62781**, a high-severity remote code execution flaw in the Windows **RPC Runtime Library** that allows an unauthenticated attacker to execute code over the network. The heap-based buffer overflow, tracked as **CWE-122** and scored **CVSS 8.1**, affects a broad range of Windows client and server platforms, including Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, 2022, and 2025, according to the CVE entry and Microsoft advisory. The exposure is notable because exploitation of remote services has repeatedly enabled rapid lateral movement and internal propagation across Windows environments. MITRE ATT&CK maps this activity to **`T1210`**, citing past abuse of SMB, Netlogon, RPC, and Print Spooler flaws by threats such as WannaCry, NotPetya, TrickBot, Conficker, and multiple intrusion groups; Splunk has also tied remote-service exploitation detections to the same technique in prior RCE-related content. Security teams are likely to treat the new RPC flaw as a priority patching issue given its network-reachable nature and the history of Windows remote-service vulnerabilities being used for enterprise-wide spread.
Aug 12, 2026
Microsoft released fixes for **critical remote code execution vulnerabilities** in the Windows RPC Runtime, including **`CVE-2022-26809`**, a flaw in `rpcrt4.dll` that could allow **unauthenticated, zero-click code execution** on vulnerable systems. Security reporting said the bug stemmed from an integer overflow that could lead to a heap buffer overflow during RPC processing, affecting both client-side and server-side code paths in Windows. Researchers warned that unpatched systems exposing **TCP port `445`** were at particular risk, with internet scanning indicating that **more than 700,000** Windows machines could be reachable and potentially vulnerable. Microsoft’s April security updates addressed the issue, while defenders were urged to **apply patches**, **block external access to port `445`**, and **restrict inbound connections** to reduce exposure.
Aug 6, 2026