EUVD-2026-35133
GHSA-489c-3g86-35rh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
OpenBullet2 through version 0.3.2 on Windows contains a credential disclosure vulnerability that allows remote attackers to capture the NTLMv2 hash of the process user by configuring a job proxy source with a UNC path pointing to an attacker-controlled server. When the job starts, the application attempts to load proxies from the UNC path, triggering an SMB authentication attempt that discloses the NTLMv2 hash, which can then be relayed or cracked offline.
AnalysisAI
Credential disclosure in OpenBullet2 through 0.3.2 on Windows allows authenticated remote attackers to coerce SMB authentication and capture NTLMv2 hashes by configuring a job's proxy source with an attacker-controlled UNC path. Captured hashes can be relayed against other services or cracked offline to recover the password of the account running the application. Publicly available exploit code exists per VulnCheck advisory; no CISA KEV listing at time of analysis.
Technical ContextAI
OpenBullet2 is an open-source web testing suite (often associated with credential stuffing research) built on .NET and run on Windows hosts. The vulnerability is rooted in CWE-522 (Insufficiently Protected Credentials): when the application's proxy-loading routine accepts a UNC path (\\host\share\file), the underlying Windows SMB client automatically negotiates authentication with the remote SMB server using the current user's NTLMv2 challenge-response. An attacker controlling that server (e.g., via Responder or Impacket's smbserver) captures the Net-NTLMv2 hash. The affected CPE is cpe:2.3:a:openbullet:openbullet2:* covering all versions up to and including 0.3.2.
RemediationAI
No vendor-released patch identified at time of analysis - the input lists no fixed version beyond 0.3.2. As compensating controls, restrict the OpenBullet2 host's outbound SMB traffic by blocking TCP/445 and TCP/139 egress at the host or perimeter firewall (side effect: legitimate SMB to external file shares also breaks, which is rarely needed for this workload); enable SMB signing and, on supported Windows builds, disable NTLM outbound entirely via the Group Policy setting "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" set to Deny all (side effect: any remaining NTLM-dependent integrations will fail and must be migrated to Kerberos). Run OpenBullet2 under a low-privilege local account whose hash has no value elsewhere, and restrict who can configure job proxy sources. Monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/openbullet2-ntlmv2-hash-disclosure-via-unc-path-proxy-source) for a patched release.
More in Openbullet2
View allAuthentication bypass in OpenBullet2 through 0.3.2 lets unauthenticated remote attackers obtain full admin access by sen
Remote code execution in OpenBullet2 through 0.3.2 allows authenticated users to execute arbitrary OS commands by abusin
Path traversal in OpenBullet2 through 0.3.2 lets authenticated attackers read, write, and delete arbitrary files via the
Authenticated remote code execution in OpenBullet2 through version 0.3.2 allows any logged-in user to run arbitrary C# c
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today