Loading vulnerability…
CVE-2015-5736 is a local privilege escalation vulnerability in the Fortishield.sys driver shipped with Fortinet FortiClient before version 5.2.4. The driver improperly trusts user-supplied input in IOCTL handlers for control codes 0x220024 and 0x220028, allowing a local user to set a callback function pointer. Because the driver does not adequately validate or restrict the callback target before invoking it in kernel context, an attacker can redirect execution to arbitrary code and achieve code execution in the Windows kernel.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository contains a local privilege escalation exploit targeting Windows 10 20H2, specifically leveraging CVE-2021-31955, CVE-2015-4077, and CVE-2015-5736. The main exploit logic resides in 'forti_exploit.cpp', which orchestrates the attack by leaking kernel addresses, manipulating kernel memory, and ultimately stealing the SYSTEM token using custom shellcode found in 'token_stealing.asm'. The exploit is operational but not weaponized, as it relies on hardcoded offsets and is not version-independent. The exploit launches a SYSTEM-level command shell upon success. The repository includes standard C++ project files and headers, with the main entry point in 'forti_exploit.cpp'. No network endpoints are involved; the attack vector is purely local, requiring code execution on the target machine. The exploit manipulates specific files in the user's AppData directory as part of its process.
This repository is a proof-of-concept (PoC) exploit for CVE-2015-5736, targeting a vulnerability in the FortiShield.sys driver on Windows. The main exploit logic resides in 'src/CVE-2015-5736.cpp', which orchestrates the attack by interacting with the vulnerable driver via the device interface '\\.\FortiShield'. The exploit constructs a ROP chain to manipulate kernel memory, specifically overwriting the PreviousMode field and stealing the SYSTEM process token, ultimately spawning a SYSTEM-level command prompt. Supporting code in 'Common.c', 'Common1.cpp', and their headers provides utility functions for kernel memory manipulation, driver base address resolution, and process/thread enumeration. The repository also includes a large text file ('rp-win/Forti_va0_3.txt') containing ROP gadget offsets for the FortiShield.sys driver, which are used to build the ROP chain. The exploit requires local access and sufficient privileges to interact with device drivers. No network endpoints are present; all interactions are with local files and device handles. The code is operational and demonstrates a full privilege escalation attack, but is not weaponized for mass exploitation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.