CVE-2026-9198 is an unauthenticated remote code execution vulnerability chain in Langflow OSS when AUTO_LOGIN is enabled. An unauthenticated network attacker can exploit CVE-2026-9103 to obtain a superuser access token from /api/v1/auto_login without credentials, then leverage CVE-2026-8481 in /api/v1/validate/code to execute user-controlled Python through exec(). By chaining these vulnerabilities, CVE-2026-9198 allows arbitrary command execution on the Langflow server. Langflow OSS versions 1.0.0 through 1.10.0, inclusive, are vulnerable. The vulnerability is fixed in version 1.10.1. The module performs the following steps: 1. Uses the selected web page URL to identify the Langflow scheme, host, port, and base path. 2. Requests an access token without credentials from /api/v1/auto_login. 3. Queries /api/v1/users/whoami and requires the returned user to have is_superuser set to true, confirming CVE-2026-9103. 4. Queries the superuser-protected /api/v1/users/?limit=1 endpoint and requires an HTTP 200 response as a second privilege check. 5. Submits a crafted Python function decorator to /api/v1/validate/code. The decorator executes immediately through exec(), and the module recovers command output from function.errors. 6. Executes the whoami command, recovers its output, and identifies the operating system reported by the vulnerable Langflow Python process, confirming CVE-2026-8481 and the complete CVE-2026-9198 chain. 7. When DEPLOY OSCI AGENT is enabled, the module commits a non-blind OSCI agent associated with CVE-2026-9198 that reuses the same Langflow primitive to relaunch commands later without copying an Impact executable to the target. 8. Stores the Langflow connection parameters required to request a fresh AUTO_LOGIN token whenever the OSCI agent executes a command. 9. Relaunches commands through /api/v1/validate/code and returns their standard output and exit status to the Impact console. 10. When DEPLOY NETWORK AGENT is enabled, the module stages an Impact payload from the embedded web server and launches it through the vulnerable Langflow service. 11. Waits for the native agent connection, associates a successful deployment with CVE-2026-9198, and performs the cleanup required by the selected deployment method. The executed commands and any deployed agent will run with the privileges of the Langflow service account.

CVE-2026-9198 is an unauthenticated remote code execution vulnerability chain in Langflow OSS when AUTO_LOGIN is enabled. An unauthenticated network attacker can exploit CVE-2026-9103 to obtain a superuser access token from /api/v1/auto_login without credentials, then leverage CVE-2026-8481 in /api/v1/validate/code to execute user-controlled Python through exec(). By chaining these vulnerabilities, CVE-2026-9198 allows arbitrary command execution on the Langflow server. Langflow OSS versions 1.0.0 through 1.10.0, inclusive, are vulnerable. The vulnerability is fixed in version 1.10.1. The module performs the following steps: 1. Determines whether the Langflow service uses plain HTTP or HTTPS. 2. Requests an access token without credentials from /api/v1/auto_login. 3. Queries /api/v1/users/whoami and requires the returned user to have is_superuser set to true, confirming CVE-2026-9103. 4. Queries the superuser-protected /api/v1/users/?limit=1 endpoint and requires an HTTP 200 response as a second privilege check. 5. Submits a crafted Python function decorator to /api/v1/validate/code. The decorator executes immediately through exec(), and the module recovers command output from function.errors. 6. Executes the whoami command, recovers its output, and identifies the operating system reported by the vulnerable Langflow Python process, confirming CVE-2026-8481 and the complete CVE-2026-9198 chain. 7. When DEPLOY OSCI AGENT is enabled, the module commits a non-blind OSCI agent associated with CVE-2026-9198 that reuses the same Langflow primitive to relaunch commands later without copying a Core Impact executable agent into the target. 8. Stores the Langflow connection parameters required to request a fresh AUTO_LOGIN token whenever the OSCI agent executes a command. 9. Relaunches commands through /api/v1/validate/code and returns their standard output and exit status to the Impact console. 10. When DEPLOY NETWORK AGENT is enabled, the module stages an Impact payload from the embedded web server and launches it through the vulnerable Langflow service. 11. Waits for the native agent connection, associates a successful deployment with CVE-2026-9198, and performs the cleanup required by the selected deployment method. The executed commands and any deployed agent will run with the privileges of the Langflow service account.

The module authenticates to Configuration Manager AdminService with a low-privileged domain identity and calls UploadExtensionInChunks. The exploit uses an Authenticode-signed CAB to extract a path traversal to place an adsource.dll proxy and a preserved original DLL in the Configuration Manager bin X64 directory. Active Directory System Discovery subsequently loads the proxy in SMS_EXECUTIVE and modifies the built-in RID-500 account as NT AUTHORITY\\SYSTEM. The module then authenticates over SMB with that local administrator and deploys an Impact agent as SYSTEM. An HTTP 500 response can occur after successful CAB extraction and is therefore not treated as definitive failure. The agent callback is the success condition.

ResetNightmare is an authorization flaw in the Microsoft Kerberos Change Password protocol. On an unpatched domain controller, an attacker who can write the userPrincipalName attribute of a controlled account can obtain a kadmin/changepw ticket whose client name identifies another account while its PAC identifies the controlled account. The module temporarily changes the controlled account's UPN to the target sAMAccountName, requests a kadmin/changepw ticket with an NT-ENTERPRISE client name, restores the original UPN, and uses the ticket in an RFC 3244 password-change exchange. The target credentials are verified and stored as an Impact identity by default. The controlled account can be an existing user or computer whose cleartext password is known and whose userPrincipalName can be modified.

This module exploits CVE-2026-53365, to elevate privileges on a Linux target. The vulnerability is a page-reference-count underflow in the Linux kernel io_uring zero-copy send path over AF_VSOCK. It can free a page that remains pinned and allow the page to be reclaimed as privileged file page-cache data. The exploit uses the vulnerability to modify the interpreter path in the page-cache contents of "/usr/bin/su" and execute a caller-supplied ELF with root privileges. The module uploads the exploit binary and a generated Core Impact agent ELF with random names to the directory selected by the TMP_DIR parameter. After successful exploitation, its setuid helper executes that agent with root privileges. Before exploitation, the module refuses to continue if the cached "/usr/bin/su" image already references the exploit interpreter and removes stale files from previous failed attempts. After the privileged interpreter has executed, the exploit restores the original cached "/usr/bin/su" ELF page through its fixed-buffer alias before tearing down the io_uring worker. After the new agent connects, the module waits for a privileged filesystem-cache eviction, verifies that the cached "/usr/bin/su" image no longer references the exploit interpreter, and removes the uploaded files and fixed-name exploit artifacts. Even after successful restoration, another exploitation attempt requires a reboot because the affected page and allocator state are not reusable during the same boot.

This module exploits CVE-2026-66804, an improper access control vulnerability in the Microsoft Windows Cross Device Service, to execute a CORE Impact agent with NT AUTHORITY\SYSTEM privileges. Windows registers the Cross Device virtual-camera COM server at PROGRAMDATA\CrossDevice\CrossDevice.Streaming.Source.dll. On affected systems, the machine-wide registration can exist while PROGRAMDATA\CrossDevice is absent and creatable by a standard user. An attacker can create that missing directory and plant the registered COM DLL. Starting the Cross Device virtual camera then causes Windows Camera Frame Server to load the attacker-controlled DLL as NT AUTHORITY\LOCAL SERVICE. The payload DLL elevates from LOCAL SERVICE to SYSTEM and starts a staged CORE Impact agent. The module follows the guarded fresh-VM reproduction flow: Requires an x64 agent running at medium integrity. Validates the exact machine-wide Cross Device COM registration and requires PROGRAMDATA\CrossDevice to be absent. Stages the CORE Impact agent, creates PROGRAMDATA\CrossDevice, and plants the payload DLL. Starts the Cross Device virtual camera through Media Foundation. Waits for the new agent and verifies that it is running as NT AUTHORITY\SYSTEM.

This module exploits an information disclosure vulnerability in Microsoft Windows Snipping Tool. A malicious web page invokes the ms-screensketch URI handler with an attacker-controlled UNC path. When the victim allows the browser to open Snipping Tool, the application connects to the SMB server and discloses the current user's Net-NTLM response. This exploit does not install an agent.

Microsoft Windows is vulnerable to a use-after-free in win32kfull!WindowActions::xxxInterceptSetWindowPos. The vulnerability can be triggered while processing deferred window-position operations for intercept windows, allowing freed kernel memory to be reclaimed with attacker-controlled allocations. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges. The steps performed by the binary exploit are: Create intercept windows and deferred window-position objects to trigger the use-after-free Perform heap feng shui and spray restricted token objects to reclaim the freed allocation Corrupt a duplicated token's user and group information and replace it with SYSTEM security identifiers Impersonate the corrupted token and use winlogon.exe as the parent of a new elevated process Execute the uploaded agent as SYSTEM

This module exploits CVE-2026-63077, a pre-authentication unsafe XML deserialization vulnerability in JetBrains TeamCity On-Premises. It registers a synthetic build agent through the agent polling protocol and submits a crafted XML document using the resulting agent session, without requiring TeamCity user credentials. Deserialization of the payload initializes an in-memory HSQLDB data source and uses HSQLDB's SCRIPT functionality to write a temporary JSP payload into the TeamCity ROOT web application. The module requests this JSP to execute an operating-system command as the account running the TeamCity server service. The JSP captures combined standard output and standard error, deletes itself when invoked, and is guarded against repeated execution. The module can verify the vulnerability, identify Linux or Windows targets, execute commands, and deploy an encrypted OSCI agent. It supports HTTP and HTTPS targets, including IPv6 addresses. Agent deployment is implemented for x86-64 Linux and Windows systems. Each command requires three HTTP requests: synthetic-agent registration, delivery of the deserialization payload, and invocation of the generated JSP. Commands are limited to 2026 characters, execution is limited to approximately 10 seconds, and captured output is limited to 1 MiB. Commands are executed with the privileges of the TeamCity server process. The exploit was tested against TeamCity 2025.11.6 on Ubuntu Linux 26.04 LTS and Windows Server 2025 Datacenter. Other vulnerable versions or platforms may also be affected but have not been verified by the engineering team.

This module exploits CVE-2026-63077, a pre-authentication unsafe XML deserialization vulnerability in JetBrains TeamCity On-Premises. It registers a synthetic build agent through the agent polling protocol and submits a crafted XML document using the resulting agent session, without requiring TeamCity user credentials. Deserialization of the payload initializes an in-memory HSQLDB data source and uses HSQLDB's SCRIPT functionality to write a temporary JSP payload into the TeamCity ROOT web application. The module requests this JSP to execute an operating-system command as the account running the TeamCity server service. The JSP captures combined standard output and standard error, deletes itself when invoked, and is guarded against repeated execution. The module can verify the vulnerability, identify Linux or Windows targets, execute commands, and deploy an encrypted OSCI agent. It supports HTTP and HTTPS targets, including IPv6 addresses. Agent deployment is implemented for x86-64 Linux and Windows systems. Each command requires three HTTP requests: synthetic-agent registration, delivery of the deserialization payload, and invocation of the generated JSP. Commands are limited to 2026 characters, execution is limited to approximately 10 seconds, and captured output is limited to 1 MiB. Commands are executed with the privileges of the TeamCity server process. The exploit was tested against TeamCity 2025.11.6 on Ubuntu Linux 26.04 LTS and Windows Server 2025 Datacenter. Other vulnerable versions or platforms may also be affected but have not been verified by the engineering team.