{"id":"CVE-2026-15430","aliases":["EUVD-2026-52326","GHSA-gmfc-jwm3-239r"],"status":"published","title":"CVE-2026-15430","description":"Improper access control in the IRP_MJ_WRITE command interface in\r\nWellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to\r\nNT AUTHORITY\\SYSTEM, extract credentials from PPL-protected\r\nlsass.exe, and terminate PPL-protected security processes.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00153,"percentile":0.04429,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-269","CWE-284","CWE-732"],"published":"2026-08-03T14:45:57Z","modified":"2026-10-23T21:10:00Z","exploits":[{"source":"pocgithub","id":"BlackSnufkin/AxHunter","title":"BlackSnufkin/AxHunter","date":"2026-08-05","url":"https://github.com/BlackSnufkin/AxHunter"}],"products":[{"vendor":"wellbia","product":"xigncode3"}],"references":[{"url":"https://blacksnufkin.github.io/posts/Hunting-the-Hunter-II/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15430"},{"url":"https://blacksnufkin.github.io/posts/Hunting-the-Hunter-II"},{"url":"https://github.com/advisories/GHSA-gmfc-jwm3-239r"}],"sources":{"cve":[{"id":"CVE-2026-15430","title":"CVE-2026-15430","description":"Improper access control in the IRP_MJ_WRITE command interface in\r\nWellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to\r\nNT AUTHORITY\\SYSTEM, extract credentials from PPL-protected\r\nlsass.exe, and terminate PPL-protected security processes.","status":"published","published":"2026-08-03T14:45:57.35Z","modified":"2026-08-03T19:19:47.742Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-732","CWE-269","CWE-284"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-52326","description":"Improper access control in the IRP_MJ_WRITE command interface in\r\nWellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to\r\nNT AUTHORITY\\SYSTEM, extract credentials from PPL-protected\r\nlsass.exe, and terminate PPL-protected security processes.","status":"published","published":"2026-08-03T14:45:57Z","modified":"2026-08-03T19:19:47Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:23.68186Z"}],"ghsa":[{"id":"GHSA-gmfc-jwm3-239r","title":"Improper access control in the IRP_MJ_WRITE command interface in\nWellbia XIGNCODE3 xhunter2.sys,...","description":"Improper access control in the IRP_MJ_WRITE command interface in\nWellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to\nNT AUTHORITY\\SYSTEM, extract credentials from PPL-protected\nlsass.exe, and terminate PPL-protected security processes.","status":"published","published":"2026-08-03T18:30:45Z","modified":"2026-08-03T21:32:41Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:10:03.433591Z"}],"nvd":[{"id":"CVE-2026-15430","description":"Improper access control in the IRP_MJ_WRITE command interface in\r\nWellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to\r\nNT AUTHORITY\\SYSTEM, extract credentials from PPL-protected\r\nlsass.exe, and terminate PPL-protected security processes.","status":"published","published":"2026-08-03T16:16:28.123Z","modified":"2026-10-23T21:10:00.157Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-269","CWE-284","CWE-732"],"updated_at":"2026-11-02T14:12:34.643497Z"}]}}