Resources
Blog

CVE-2026-62735: Understanding the HTTP.sys Integer Overflow

By Cristian Rubio on Wed, 10/21/2026
Introduction CVE-2026-62735 is an integer overflow in HTTP.sys response-size accounting that can lead to local privilege escalation. This post follows the published research, including Huy Hoàng Nguyễn’s exploitation analysis, to explain how an undersized response buffer leads to memory corruption and privilege escalation. This analysis was conducted while developing an exploit for Core Impact,...
Blog

CVE-2026-81963: From a Public CBS Session to SYSTEM Code Execution

By Ricardo Narvaja on Wed, 09/30/2026
Hi, I’m Ricardo Narvaja, working as Principal Exploit Writer at Fortra , researching anddeveloping exploits for Core Impact. I have been working on this new vulnerability, CVE-2026-81963, published on September Patch Tuesday, for which there is currently no technical information available (at least as of the time of writing this blog post); I would like to share the work I have done involving...
Blog

CVE-2026-62832 LegacyHive — Moving on to the next steps

By Ricardo Narvaja on Thu, 09/10/2026
LegacyHive is an interesting Windows Profile Service vulnerability published by MSNightmare. The public repository describes it as an arbitrary hive-load privilege-escalation vulnerability and makes an unusually direct statement: the released proof of concept was deliberately stripped down, while the original version allegedly needed no additional user credentials and was not limited to UsrClass...
Blog

Analysis of CVE-2026-35273: Oracle PeopleSoft PeopleTools Server Side Request Forgery

By Marcos Accossatto on Mon, 06/29/2026
CVE-2026-35273 is a serious vulnerability affecting Oracle PeopleSoft PeopleTools. It involves a server-side request forgery weakness that allows an attacker to make the PeopleSoft system send requests internally, including to sensitive components that are not normally exposed to outside users.The still active exploitation from UNC6240 (ShinyHunters) (as stated by Mandiant and Google Threat...
Offensive Cybersecurity
Penetration Testing
blog article thumbnail
Blog

What's New in Impacket 0.13.1?

By Gabi Gonzalez on Tue, 05/19/2026
Impacket 0.13.1 is almost ready to land. This release keeps the momentum from 0.13 going with new relay surfaces, stronger support for modern Windows and SQL Server environments, and a set of practical improvements across the examples scripts.Impacket 0.13.1 is a focused maintenance release. We decided not to wait for the full 0.14 cycle because several fixes and improvements around Kerberos, SMB,...
Offensive Cybersecurity
new exploit blog
Blog

Core Impact Chronicle: Exploits and Updates | Q1 2026

By Pablo Zurro on Fri, 04/24/2026
Core Impact Exploit Library AdditionsOne of Core Impact’s most valuable features is its certified exploit library, maintained by a team (formerly Core Labs) within the Fortra Intelligence & Research Experts (FIRE) group. This team conducts in-depth research to evaluate and prioritize the most critical vulnerabilities, ensuring the library is updated with high-impact, reliable exploits that enable...
Offensive Cybersecurity
Penetration Testing
Core Security blog thumbnail
Blog

Best Security Practices for Digital Banking

Tue, 04/21/2026
Online banking is now nearly universal. Long lines at the credit union, late-night ATM trips, and waiting for checks to clear have largely become a thing of the past. Digital banking has revolutionized the financial industry and the way we do business as a whole. However, it has also indelibly increased the risk of cyberattacks, social engineering scams, and online compromise to the financial...
Offensive Cybersecurity
Blog

Analysis of RedSun: Local Privilege Escalation via Defender Remediation Abuse

By Cristian Rubio on Fri, 04/17/2026
Fortra Intelligence and Research Experts (FIRE) have conducted a detailed analysis of RedSun, the latest proof-of-concept by "Chaotic Eclipse", the same researcher responsible for disclosing BlueHammer. Published in April 2026, RedSun is related to BlueHammer both in origin and technique, abusing Microsoft Defender logic and filesystem timing/path confusion to achieve privilege escalation...
Offensive Cybersecurity
Penetration Testing
Blog

Analysis of BlueHammer: LPE Exploiting Windows Defender Updates 

By Cristian Rubio on Mon, 04/13/2026
Fortra Intelligence and Research Experts (FIRE) have conducted a deep technical analysis of BlueHammer, a highly sophisticated Windows zero-day exploit chain that achieves Local Privilege Escalation (LPE) to NT AUTHORITY\SYSTEM. To help security teams better navigate the advanced threat landscape, we are sharing this technical deep dive into how the exploit operates and how to defend against it...
Offensive Cybersecurity
Core Security article thumbnail
Blog

CVE-2026-2636: Using ReadFile with Handle of Opened .blf Log File Produces an Unrecoverable State in CLFS.sys Causing a BSoD

By Ricardo Narvaja on Wed, 02/25/2026
IntroductionWhile researching the Common Log File System (CLFS) to analyze a published vulnerability, I achieved remote code execution (RCE). However, after modifying certain values in a proof of concept (PoC), I observed that it triggered a non‑exploitable blue screen of death (BSoD) on the target system. Consequently, I am reporting this issue. This document helps the reader understand the BSoD...
Penetration Testing
new exploit blog
Blog

Core Impact Chronicle: Exploits and Updates | H2 2025

By Pablo Zurro on Fri, 02/06/2026
Core Impact Exploit Library AdditionsOne of Core Impact’s most valuable features is its certified exploit library, maintained by a team (formerly Core Labs) within the Fortra Intelligence & Research Experts (FIRE) group. This team conducts in-depth research to evaluate and prioritize the most critical vulnerabilities, ensuring the library is updated with high-impact, reliable exploits that enable...
Penetration Testing
blog article thumbnail
Blog

Core Impact 21.8: The No-Agent Agent

By Pablo Zurro on Tue, 12/09/2025
We’re excited to share what’s new in Core Impact v21.8! This release is all about making your penetration testing workflows more efficient, more integrated, and easier to manage. Let’s dive into the highlights.Smarter Agent DeploymentAgents are at the heart of Core Impact, and we’ve made them even better:New OSCI Agent Entity In many cases, it is very difficult to get an agent deployed on a...
Penetration Testing