Is there a public PoC exploit available for CVE-2026-15476?

Yes, a public proof-of-concept exploit is available for CVE-2026-15476. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-15476?

Yes, a patch is available for CVE-2026-15476. Update the affected software to the latest version immediately.

QILING Disk Master CVE-2026-15476

Q: What is the CVSS score of CVE-2026-15476?

CVE-2026-15476 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-43198 LOW

Improper Access Control (CWE-284)

2026-07-12 VulDB

GHSA-fv2q-hqcx-c836

Authentication Bypass Disk Master

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

AV:L and PR:L align with local low-priv exploitation; impact held at Low across CIA consistent with CVSS 4.0 VC:L/VI:L/VA:L, despite conflicting exploit-title claim of privilege escalation.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 12, 2026 - 04:22 NVD

MEDIUM LOW

CVSS changed

Jul 12, 2026 - 04:22 NVD

4.8 (MEDIUM) 1.9 (LOW)

Analysis Generated

Jul 12, 2026 - 03:58 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the library diskbckp.sys of the component Kernel Driver. Such manipulation leads to improper access controls. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. It is suggested to upgrade the affected component.

AnalysisAI

Improper access control in the diskbckp.sys kernel driver of QILING Disk Master 6.0.0.0 allows local low-privileged users to bypass authorization checks and interact with privileged kernel driver functionality. Tagged as an authentication bypass, the flaw resides in an unknown function within the kernel driver component, enabling manipulation of access control logic without elevated credentials. A public proof-of-concept exploit has been disclosed (no CISA KEV listing); the vendor has released a patch via beta download.

Technical ContextAI

The affected component is diskbckp.sys, a kernel-mode driver bundled with QILING Disk Master (CPE: cpe:2.3:a:qiling:disk_master:*:*:*:*:*:*:*:*) on Windows. Kernel drivers expose IOCTL (I/O Control Code) interfaces that user-mode processes invoke via the Windows DeviceIoControl API. CWE-284 (Improper Access Control) in this context typically manifests as missing or insufficiently enforced access checks on IOCTL handlers, allowing any process - including those running with standard user privileges - to invoke operations intended exclusively for administrative callers. The 'Authentication Bypass' tag corroborates that the driver fails to adequately validate the privilege level of the requesting process before servicing sensitive requests, a well-known vulnerability class in third-party Windows kernel drivers.

RemediationAI

The vendor has released a patched build available for download at https://www.idiskhome.com/download/beta/multi_DiskMaster_Pro_Trial.exe - users should upgrade immediately. The exact fixed version number is not independently confirmed from available data and should be verified against the vendor's release notes before deployment. If immediate upgrade is not feasible, restrict local interactive login access to non-administrative users on systems running QILING Disk Master, reducing the pool of accounts capable of exploiting the driver. As a deeper compensating control, an administrator can disable or unload the diskbckp.sys driver service (e.g., via sc stop and sc config to set start=disabled) until patching is complete, with the trade-off that disk backup functionality will be unavailable for the duration. These mitigations reduce attack surface but do not remediate the underlying access control flaw.