Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected security processes.
Fix
Public exploits 1
- BlackSnufkin/AxHunter PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
STIG rules that mitigate this class
Credential Guard isolates NTLM hashes and Kerberos tickets from the LSASS process the class of flaw reads. Microsoft Learn, "Credential Guard overview" (the owner's mapping, data/mitigations.yaml: credential-guard)
- WN11-CC-000075 CAT I Credential Guard must be running on Windows 11 systems. Microsoft Windows 11
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.2NVD modified 2026-10-23 21:10
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.