/
← Voltar ao feed
high exploit público

Kaspersky Q2 2026 vulnerability report: record CVE volume, Linux Dirty Frag LPEs, Windows zero-day exploit leaks and APT use of AI tool flaws

1 fonte(s) · 1 atualização(ões) · publicado 26/08/2026 07:00 · coletado há 1 dia

Kaspersky's Q2 2026 vulnerability landscape report records an unprecedented number of registered CVEs, including critical ones. It attributes the surge mainly to AI-assisted vulnerability discovery and AI-generated code. Researchers are also publishing exploits for unpatched flaws more often. One example is Nightmare Eclipse (Chaotic Eclipse), who released unpatched, CVE-less Windows exploits such as BlueHammer, RedSun, YellowKey, GreenPlasma, RoguePlanet and UnDefend. On Linux, the Dirty Frag family and related page-cache privilege escalation flaws were quickly adopted by attackers. APT groups increasingly exploit new vulnerabilities from the day of publication, and Langflow is cited as one of the first cases of an APT exploiting AI tooling.

Technical Details

  • Windows: the unpatched, CVE-less flaws include TOCTOU/logic bugs in Windows Defender (BlueHammer, RedSun, RoguePlanet, UnDefend), a BitLocker bypass via WinRE (YellowKey) and a CTFMON object injection (GreenPlasma). Working exploits were published for several of them. Older flaws remain the most detected: CVE-2018-0802, CVE-2017-11882, CVE-2017-0199, CVE-2023-38831, CVE-2025-6218 and CVE-2025-8088. The number of Windows users encountering exploits fell to an 18-month low.
  • Linux: actively exploited local privilege escalation flaws tied to the page cache: CVE-2026-31431 (Copy Fail), CVE-2026-43284 and CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) and CVE-2026-46331 (pedit COW). Older flaws are still detected: CVE-2022-0847, CVE-2019-13272, CVE-2021-22555 and CVE-2023-32233.
  • APT exploitation with C2: exploits that interacted with C2 agents (Sliver, Havoc, AdaptixC2, Metasploit) targeted CVE-2026-35273 (Oracle PeopleSoft PeopleTools, SSRF), CVE-2023-46604 (Apache ActiveMQ), CVE-2024-12356 and CVE-2026-1731 (BeyondTrust), CVE-2023-36884 (Windows Search), CVE-2025-53770 (SharePoint) and the WinRAR flaws CVE-2025-8088 and CVE-2025-6218.
  • AI/LLM tool flaws: CVE-2026-25253 (OpenClaw gatewayUrl: the UI auto-connects to an attacker-controlled WebSocket and sends its auth token), CVE-2026-41948 (Dify path traversal that breaks tenant isolation), CVE-2026-45386 (Open WebUI missing write-permission check on pin/unpin) and CVE-2026-45501 (Microsoft Exchange improper input neutralization leading to spoofing). OpenClaw had over 200 CVEs in Q2. The main weaknesses in AI software are poor access control and authentication/authorization, and injection flaws are resurging.
  • Fake research: several Exchange and SharePoint vulnerability write-ups and exploits published in the quarter were AI-generated fakes meant to mislead researchers, and some were bundled with unrelated malware.

Remediation

  • Patch quickly, or disable vulnerable kernel modules on Linux where patching is not possible.
  • Keep Windows and Office software, including WinRAR, up to date.
  • Develop secure procedures for credential use and sensitive data handling in agent/LLM-based systems.
  • Monitor systems and access controls in real time.
  • Treat unverified public exploit code and vulnerability write-ups with caution.

13 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2026-43284, CVE-2026-43500, CVE-2026-46300 e outros. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52591 ↗ · local · linux · pub. 29/05/2026 não verificado

    Linux Kernel - Local Privilege Escalation

    This Exploit-DB entry is a write-up, not exploit code. It describes a local privilege escalation chaining three Linux kernel flaws: the xfrm ESP handling with extended sequence numbers, RxRPC in-place decryption, and ESP-in-TCP fragment coalescing. Together they would let an unprivileged local user write into the page cache and alter a setuid binary such as su to get root. It needs local code execution on an affected kernel with these networking features. Maturity is unclear: only a sample console output is shown, the code is linked externally, and it is unverified.

    CVE-2026-43284 CVE-2026-43500 CVE-2026-46300 · autor: nu11secur1ty · explicação gerada por IA
  2. exploit-db.com · EDB-52585 ↗ · local · linux · pub. 27/05/2026 não verificado

    Linux Kernel - Local Privilege Escalation

    A local unprivileged user chains two Linux kernel bugs: an xfrm ESP logic error with Extended Sequence Numbers that allows small writes into the page cache, and an RxRPC flaw that decrypts cached pages in place. This lets the attacker alter the in-memory copy of a setuid binary and get root. It needs local code execution on an affected kernel (2017 to May 2026) with these features reachable. The file is just a write-up with claimed output; the code is linked externally and unverified.

    CVE-2026-43284 CVE-2026-43500 · autor: nu11secur1ty · explicação gerada por IA
  3. exploit-db.com · EDB-52405 ↗ · remoto · windows · pub. 11/08/2025 não verificado

    Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)

    This script targets the ToolPane page of on-premises SharePoint Server 2019 (CVE-2025-53770, unsafe deserialization known as ToolShell). It needs only network access to the web front end and no login, since it fakes a sign-out referrer to skip authentication. It submits a crafted web part with an ExcelDataSet control, then only reads the reply, decodes a returned data blob and looks for keywords. It runs no commands and drops no web shell, so it is a rough exposure check, not the working RCE its title claims.

    CVE-2025-53770 · autor: Agampreet Singh · explicação gerada por IA

Linha do tempo

  1. securelist.com ↗ · pub. 26/08/2026 07:00 · coletado 19/10 17:57 primeiro registro

    Kaspersky Q2 2026 vulnerability report: record CVE volume, Linux Dirty Frag LPEs, Windows zero-day exploit leaks and APT use of AI tool flaws

    ler a análise desta fonte

    Kaspersky's Q2 2026 vulnerability landscape report records an unprecedented number of registered CVEs, including critical ones. It attributes the surge mainly to AI-assisted vulnerability discovery and AI-generated code. Researchers are also publishing exploits for unpatched flaws more often. One example is Nightmare Eclipse (Chaotic Eclipse), who released unpatched, CVE-less Windows exploits such as BlueHammer, RedSun, YellowKey, GreenPlasma, RoguePlanet and UnDefend. On Linux, the Dirty Frag family and related page-cache privilege escalation flaws were quickly adopted by attackers. APT groups increasingly exploit new vulnerabilities from the day of publication, and Langflow is cited as one of the first cases of an APT exploiting AI tooling.

    Technical Details

    • Windows: the unpatched, CVE-less flaws include TOCTOU/logic bugs in Windows Defender (BlueHammer, RedSun, RoguePlanet, UnDefend), a BitLocker bypass via WinRE (YellowKey) and a CTFMON object injection (GreenPlasma). Working exploits were published for several of them. Older flaws remain the most detected: CVE-2018-0802, CVE-2017-11882, CVE-2017-0199, CVE-2023-38831, CVE-2025-6218 and CVE-2025-8088. The number of Windows users encountering exploits fell to an 18-month low.
    • Linux: actively exploited local privilege escalation flaws tied to the page cache: CVE-2026-31431 (Copy Fail), CVE-2026-43284 and CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) and CVE-2026-46331 (pedit COW). Older flaws are still detected: CVE-2022-0847, CVE-2019-13272, CVE-2021-22555 and CVE-2023-32233.
    • APT exploitation with C2: exploits that interacted with C2 agents (Sliver, Havoc, AdaptixC2, Metasploit) targeted CVE-2026-35273 (Oracle PeopleSoft PeopleTools, SSRF), CVE-2023-46604 (Apache ActiveMQ), CVE-2024-12356 and CVE-2026-1731 (BeyondTrust), CVE-2023-36884 (Windows Search), CVE-2025-53770 (SharePoint) and the WinRAR flaws CVE-2025-8088 and CVE-2025-6218.
    • AI/LLM tool flaws: CVE-2026-25253 (OpenClaw gatewayUrl: the UI auto-connects to an attacker-controlled WebSocket and sends its auth token), CVE-2026-41948 (Dify path traversal that breaks tenant isolation), CVE-2026-45386 (Open WebUI missing write-permission check on pin/unpin) and CVE-2026-45501 (Microsoft Exchange improper input neutralization leading to spoofing). OpenClaw had over 200 CVEs in Q2. The main weaknesses in AI software are poor access control and authentication/authorization, and injection flaws are resurging.
    • Fake research: several Exchange and SharePoint vulnerability write-ups and exploits published in the quarter were AI-generated fakes meant to mislead researchers, and some were bundled with unrelated malware.

    Remediation

    • Patch quickly, or disable vulnerable kernel modules on Linux where patching is not possible.
    • Keep Windows and Office software, including WinRAR, up to date.
    • Develop secure procedures for credential use and sensitive data handling in agent/LLM-based systems.
    • Monitor systems and access controls in real time.
    • Treat unverified public exploit code and vulnerability write-ups with caution.