Loading vulnerability…
CVE-2026-49176 is an improper privilege management vulnerability in Windows WalletService, a LocalSystem component exposed through the public Windows Wallet WinRT API. WalletService resolves a Wallet database location using the caller's user-controlled Documents known-folder mapping while impersonating that caller, then reverts to its LocalSystem context before opening and processing the database. A low-privileged user can redirect the Documents location and cause the service to consume an attacker-prepared Extensible Storage Engine database. Persisted callback metadata in that database can direct the database engine to load an attacker-controlled DLL into the WalletService process under LocalSystem privileges.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a real Cobalt Strike BOF exploit for CVE-2026-49176, a local privilege escalation in Microsoft WalletService on Windows. It is not a scanner or detection script. The exploit chain is fully operationalized for Beacon and is designed to take a medium-integrity x64 Beacon and elevate to NT AUTHORITY\SYSTEM. Repository structure is compact and purpose-built: README.md documents the vulnerability and usage; cve2026_49176.cna is the Cobalt Strike aggressor script that registers the Beacon command, loads the BOF object, and packs the payload DLL, broker EXE, and operator command; entry.cpp is the main BOF orchestrator; payload/wallet_callback.c implements the SYSTEM callback DLL loaded by WalletService; payload/shell_broker.c is a helper executable for interactive process creation; build.bat compiles the BOF and payloads; bofdefs.h, beacon.h, and beacon-debug.h provide BOF support headers; resources/strip_bof.ps1 is an auxiliary symbol-stripping script. Main exploit capability: the BOF stages files under %LOCALAPPDATA%, seeds a malicious ESE wallet.db with a persisted callback pointing to wallet_callback.dll, redirects the current user's Documents known folder to the staging directory, and triggers WalletService through the WalletManager WinRT API. Because WalletService resolves the Documents path while impersonating the user and then reverts to LocalSystem before opening <Documents>\Wallet\wallet.db, it loads the attacker-controlled callback DLL as SYSTEM. Post-exploitation behavior is more advanced than a simple PoC. Once loaded as SYSTEM, wallet_callback.dll attempts multiple strategies to launch an operator-specified command interactively: first by stealing a full SYSTEM token from winlogon.exe in the active session, then from services.exe, then from lsass.exe, using token duplication and CreateProcessWithTokenW/CreateProcessAsUserW semantics. If those fail, it falls back to creating a temporary service whose ImagePath invokes cmd.exe to run shell_broker.exe. The broker reads command.txt and launches the requested command on winsta0\\default, then logs success or failure to result.txt. The exploit is clearly weaponized for operator use inside Cobalt Strike: it supports arbitrary command lines rather than a fixed payload, packs dependent binaries automatically, restores the Documents path after execution, and emits detailed status telemetry. There are no network C2 endpoints hardcoded in the exploit itself; the attack vector is purely local privilege escalation on Windows.
This repository is a working local privilege-escalation proof of concept for CVE-2026-49176 affecting Windows WalletService. It is not a framework module; it is a standalone exploit chain composed of PowerShell orchestration plus several native Windows binaries. Repository structure and purpose: - README.md explains the vulnerability and usage. - trigger.ps1 is the main entry point. It verifies the user is non-admin, prepares a per-run workspace under LOCALAPPDATA, copies payload components, seeds a malicious wallet database, redirects the current user’s Documents known folder to the attacker-controlled directory, triggers WalletManager::RequestStoreAsync, waits for a result log, restores the original Documents path, and validates that a SYSTEM shell was created in the expected session. - run.cmd is a convenience launcher for trigger.ps1. - build.ps1 compiles four native components with Visual Studio tools. - src/documents_path.c is a helper that gets/sets FOLDERID_Documents via SHGetKnownFolderPath and SHSetKnownFolderPath. - src/wallet_ese_seed.c creates an ESE database wallet.db with a Cards table and a Computed column configured with a persisted callback string of the form DLL!EXPORT. This is the malicious database WalletService later opens. - src/wallet_callback_shell.c is the DLL intended to be loaded by ESE persisted callbacks under LocalSystem. On DLL load it verifies it is running as SYSTEM, locates sibling files, creates a temporary Windows service pointing to shell_broker.exe and result.txt, starts it, deletes the service, and logs status. - src/shell_broker.c is the final stage. Running as SYSTEM, it duplicates its token into the active console session, enables needed privileges, and launches C:\Windows\System32\cmd.exe on winsta0\default, producing an interactive SYSTEM shell for the logged-in user. It also appends structured status lines to result.txt. Exploit capability: The exploit provides reliable local privilege escalation from a standard user to an interactive NT AUTHORITY\SYSTEM command prompt. It abuses WalletService’s handling of the user Documents folder and attacker-controlled wallet.db, specifically persisted ESE callbacks, to achieve DLL loading as LocalSystem. The payload is operational and complete, including orchestration, malicious database creation, callback DLL, service-based broker, session transfer, logging, and cleanup/restoration of the Documents path. No network communication is present. The attack vector is purely local and heavily tied to Windows filesystem paths, known-folder redirection, ESE database internals, and Windows service/token APIs.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A local elevation-of-privilege vulnerability in Microsoft Windows WalletService caused by improper privilege management, allowing an authorized local attacker to gain SYSTEM privileges by getting the service to process an attacker-controlled database and load a malicious DLL.
A local privilege escalation vulnerability in Microsoft Windows WalletService that allows a low-privileged user to gain NT AUTHORITY\SYSTEM by redirecting their Documents folder to a user-controlled path and supplying a crafted ESE wallet.db database with persisted callbacks that cause a DLL to be loaded by WalletService running as LocalSystem.
A local privilege escalation vulnerability in Windows WalletService that allows escalation to SYSTEM.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.