May 2026 (30)
CVE-2026-34342 - Windows Print Spooler Components Privilege Escalation via Race Condition
2 rules 1 TTP 1 CVECVE-2026-34342 is a race condition vulnerability in Windows Print Spooler Components that allows an authorized attacker to elevate privileges locally.
CVE-2026-34341: Windows LLDP Double Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-34341 is a double free vulnerability in the Windows Link-Layer Discovery Protocol (LLDP) that allows an authorized attacker to elevate privileges locally with a CVSS v3.1 score of 7.0.
CVE-2026-34340 - Windows Projected File System Use-After-Free Elevation of Privilege Vulnerability
2 rules 1 TTP 1 CVECVE-2026-34340 is a use-after-free vulnerability in the Windows Projected File System that allows an authorized attacker to elevate privileges locally.
CVE-2026-34337 - Windows Cloud Files Mini Filter Driver Use-After-Free Vulnerability
2 rules 1 TTP 1 CVECVE-2026-34337 is a use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver, allowing a locally authorized attacker to escalate privileges.
CVE-2026-34336 - Windows DWM Core Library Buffer Over-Read Information Disclosure
2 rules 2 TTPs 1 CVECVE-2026-34336 is a buffer over-read vulnerability in the Windows DWM Core Library, allowing a local, authenticated attacker to disclose sensitive information.
CVE-2026-34334 Windows TCP/IP Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-34334 describes a race condition vulnerability within Windows TCP/IP, enabling a locally authorized attacker to escalate privileges.
CVE-2026-34333 - Use-After-Free in Windows Win32K GRFX Allows Local Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-34333 is a use-after-free vulnerability in the Windows Win32K - GRFX component that allows a locally authorized attacker to elevate privileges.
CVE-2026-34332: Use-After-Free Vulnerability in Windows Kernel-Mode Drivers
2 rules 1 TTP 1 CVECVE-2026-34332 is a use-after-free vulnerability in Windows Kernel-Mode Drivers that allows an authorized attacker to execute code over a network.
CVE-2026-34331: Windows Win32K - GRFX Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-34331 describes a race condition vulnerability in Windows Win32K - GRFX that allows an authorized attacker to elevate privileges locally due to improper synchronization when accessing shared resources.
CVE-2026-34330 - Windows Win32K GRFX Integer Overflow Local Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-34330 is an integer overflow vulnerability in Windows Win32K - GRFX that allows a locally authenticated attacker to escalate privileges.
CVE-2026-34329 Heap-Based Buffer Overflow in Windows Message Queuing
2 rules 1 TTP 1 CVECVE-2026-34329 is a heap-based buffer overflow in Windows Message Queuing, enabling an unauthenticated attacker on an adjacent network to achieve remote code execution.
CVE-2026-33841 Heap-Based Buffer Overflow in Windows Kernel Allows Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-33841 is a heap-based buffer overflow vulnerability in the Windows Kernel that allows a locally authorized attacker to elevate privileges.
CVE-2026-33840 Use-After-Free in Windows Win32K ICOMP for Local Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-33840 is a use-after-free vulnerability in the Windows Win32K ICOMP component, allowing a locally authenticated attacker to elevate privileges.
CVE-2026-33839 - Windows Win32K GRFX Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-33839 is a race condition vulnerability in Windows Win32K - GRFX that allows an authorized local attacker to elevate privileges.
CVE-2026-33838: Windows Message Queuing Double Free Vulnerability
2 rules 1 TTP 1 CVECVE-2026-33838 is a double free vulnerability in Windows Message Queuing that allows a locally authorized attacker to elevate privileges.
CVE-2026-33837 - Windows TCP/IP Heap-Based Buffer Overflow for Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-33837 is a heap-based buffer overflow vulnerability in the Windows TCP/IP stack that allows an authenticated local attacker to elevate privileges.
CVE-2026-33835 - Windows Cloud Files Mini Filter Driver Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-33835 is a use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver, allowing a local attacker to elevate privileges.
CVE-2026-33834 - Windows Event Logging Service Improper Access Control Vulnerability
2 rules 1 TTP 1 CVECVE-2026-33834 is an improper access control vulnerability in the Windows Event Logging Service, allowing a locally authenticated attacker to escalate privileges.
CVE-2026-33833: Azure Machine Learning Spoofing Vulnerability
2 rules 1 TTP 1 CVECVE-2026-33833 describes an injection vulnerability in Azure Machine Learning that allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-33821: Microsoft Dynamics 365 Customer Insights Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-33821 is a privilege escalation vulnerability in Microsoft Dynamics 365 Customer Insights, allowing an authorized attacker to elevate privileges over a network.
CVE-2026-33110 - Microsoft SharePoint Deserialization Vulnerability
1 rule 1 TTP 1 CVECVE-2026-33110 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint, allowing an authorized attacker to achieve remote code execution over a network.
CVE-2026-32204: Azure Monitor Agent Privilege Escalation via External File Path Control
2 rules 1 TTP 1 CVECVE-2026-32204 is a privilege escalation vulnerability in Azure Monitor Agent that allows an authorized attacker with local access to elevate privileges by manipulating file names or paths.
CVE-2026-32177: .NET Heap-Based Buffer Overflow Local Privilege Escalation
2 rules 1 TTP 1 CVEA heap-based buffer overflow vulnerability, identified as CVE-2026-32177, exists in .NET, potentially allowing an unauthorized attacker to elevate privileges locally.
CVE-2026-32161 - Windows Native WiFi Miniport Driver Race Condition Vulnerability
2 rules 1 TTP 1 CVECVE-2026-32161 is a race condition vulnerability in the Windows Native WiFi Miniport Driver that allows an unauthorized attacker to execute code over an adjacent network.
CVE-2026-33117: Azure SDK Improper Authentication Vulnerability
2 rules 1 TTP 1 CVECVE-2026-33117 is a critical vulnerability in the Azure SDK that allows an unauthorized attacker to bypass a security feature over a network due to improper authentication.
AI Agent Data Theft via Indirect Prompt Injection
1 rule 2 TTPsAttackers are leveraging indirect prompt injection against AI agents with access to private data, untrusted content, and external communication channels to steal sensitive information by embedding malicious instructions in content processed by the agent.
Lateral Movement via Remote Startup Folder Modification
2 rules 3 TTPsAdversaries may achieve lateral movement by creating malicious files in remote Windows startup folders via RDP or SMB, leading to code execution upon system reboot or user logon.
Potential SharpRDP Behavior
2 rules 3 TTPsThis rule detects potential SharpRDP behavior, a tool used for authenticated command execution against a remote target via Remote Desktop Protocol (RDP) for lateral movement by identifying incoming RDP connections followed by RunMRU registry value modifications and subsequent process execution.
Execution via TSClient Mountpoint
2 rules 2 TTPsThe rule detects execution of processes from the Remote Desktop Protocol (RDP) shared mountpoint tsclient on Windows hosts, which may indicate a lateral movement attempt.
Potential Remote Desktop Shadowing Activity
3 rules 1 TTPThis brief detects potential remote desktop shadowing activity by identifying modifications to the RDP Shadow registry or the execution of processes indicative of an active RDP shadowing session, which adversaries may abuse to spy on or control other users' RDP sessions.