Xigncode3
Monthly
Privilege escalation to NT AUTHORITY\SYSTEM is achievable by any local, unprivileged user via Wellbia XIGNCODE3's kernel driver xhunter2.sys version 2026.6.1.192, due to missing access control on the IRP_MJ_WRITE command interface. Beyond SYSTEM-level execution, the flaw enables extraction of credentials from PPL-protected lsass.exe and termination of PPL-protected security processes such as EDR/AV agents, effectively disabling host defenses. No active exploitation is confirmed by CISA KEV, though the primary reference is a researcher blog post (blacksnufkin's 'Hunting the Hunter II') that strongly suggests PoC-grade research material exists.
Privilege escalation to NT AUTHORITY\SYSTEM is achievable by any local, unprivileged user via Wellbia XIGNCODE3's kernel driver xhunter2.sys version 2026.6.1.192, due to missing access control on the IRP_MJ_WRITE command interface. Beyond SYSTEM-level execution, the flaw enables extraction of credentials from PPL-protected lsass.exe and termination of PPL-protected security processes such as EDR/AV agents, effectively disabling host defenses. No active exploitation is confirmed by CISA KEV, though the primary reference is a researcher blog post (blacksnufkin's 'Hunting the Hunter II') that strongly suggests PoC-grade research material exists.