CVE-2026-62878 is a stack-based buffer overflow in Microsoft Windows DNS Server. NUL-first DNS labels collide in one NTree cache bucket until a fixed-size stack array is exceeded, corrupting the stack cookie and terminating dns.exe. An unauthenticated remote attacker can exploit this behavior to cause a denial of service. This module performs the following steps: 1. Confirms that the target recursively resolves random names below a public domain and records baseline UDP and TCP availability. 2. Sends a DNS query containing a NUL-first label and verifies that the target returns a non-authoritative NXDOMAIN or NODATA response. 3. Sends 600 unique ASCII-safe NUL-first names so distinct negative-cache nodes accumulate in the same NTree bucket. 4. Waits briefly, then probes every DNS transport that worked before the trigger and records whether the DNS service became unavailable.

Windows Error Reporting preserves attacker-controlled command-line syntax across a privilege boundary and passes it to the elevated Time Travel Debugging recorder without preserving argument boundaries. The module performs the following steps: Generates a per-run x86_64 Core Impact agent executable with a random name. Stages the exploit and agent beneath a unique directory resolved from the target's public profile. Triggers the vulnerable WER/TTD workflow and preserves the per-run context in a randomly named manifest. Launches the standalone agent as SYSTEM outside the TTD-recorded process tree. Confirms the privileged callback and removes temporary exploit artifacts on a best-effort basis.

Windows Health and Optimized Experiences Service accepts a Microsoft.Windows.Diagnostics.Lua ETW workflow event containing an attacker-controlled Lua module path without adequately authenticating the event producer. The module performs the following steps: Generates a per-run x86_64 launcher containing a LittleInjectorEgg CORE Impact agent. Stages the short-lived launcher and prepares unique temporary Lua module and trace paths. Emits a Microsoft.Windows.Diagnostics.Lua ETW workflow start event referencing the controlled Lua module. Maintains the required trace interval and emits the matching workflow stop event. Causes the LocalSystem WHESVC process to execute the Lua module and launch the staged injector. Transfers the agent into spoolsv.exe, waits for the privileged callback, and removes temporary artifacts on a best-effort basis.

CVE-2025-24813 is a path-equivalence vulnerability in the Apache Tomcat DefaultServlet partial PUT implementation that can lead to remote code execution under specific server-side conditions. The vulnerable implementation derives a temporary filename from the attacker-controlled request path by replacing path separators with dots. A crafted partial PUT path can therefore collide with the filename of a persisted session. When Tomcat restores that attacker-controlled session, unsafe Java deserialization can lead to remote command execution. Depending on the server configuration, the same underlying issue can also disclose security-sensitive uploaded files or allow attacker-controlled content to be injected into them; this module exercises the remote-code-execution condition. The module performs the following vulnerability-specific operations: Constructs a fresh version-specific Commons Collections serialized object containing the command to execute. Sends the object in a partial PUT request to a crafted path whose temporary filename collides with the FileStore session filename. Requests the selected session-aware route with the corresponding JSESSIONID, causing PersistentManager and FileStore to restore and deserialize the planted session. Retrieves a randomized command proof before confirming remote code execution and creating the OSCI agent. Successful exploitation creates an OSCI agent with the operating-system privileges of the Tomcat service account.

CVE-2025-24813 is a path-equivalence vulnerability in the Apache Tomcat DefaultServlet partial PUT implementation that can lead to remote code execution under specific server-side conditions. The vulnerable implementation derives a temporary filename from the attacker-controlled request path by replacing path separators with dots. A crafted partial PUT path can therefore collide with the filename of a persisted session. When Tomcat restores that attacker-controlled session, unsafe Java deserialization can lead to remote command execution. Depending on the server configuration, the same underlying issue can also disclose security-sensitive uploaded files or allow attacker-controlled content to be injected into them; this module exercises the remote-code-execution condition. The module performs the following vulnerability-specific operations: Constructs a fresh version-specific Commons Collections serialized object containing the command to execute. Sends the object in a partial PUT request to a crafted path whose temporary filename collides with the FileStore session filename. Requests the selected session-aware route with the corresponding JSESSIONID, causing PersistentManager and FileStore to restore and deserialize the planted session. Retrieves a randomized command proof before confirming remote code execution and creating the OSCI agent. Successful exploitation creates an OSCI agent with the operating-system privileges of the Tomcat service account.

Windows HTTP.sys is vulnerable to an integer overflow while calculating the size required for HTTP response headers. The resulting undersized nonpaged-pool allocation can be overflowed while HTTP.sys generates the response headers, producing a heap-based buffer overflow. This module executes an exploit binary in memory. The exploit uses the memory corruption to build arbitrary kernel read and write primitives, then replaces the current agent process token with the SYSTEM process token. The steps performed by the exploit are: Prepare a local HTTP server and a crafted HTTP response Spray named-pipe data queue entries in the nonpaged pool Trigger the integer overflow and corrupt an adjacent data queue entry Build arbitrary kernel read and write primitives Locate the current agent and SYSTEM process objects Copy the SYSTEM process token to the current agent process

A Windows Component Based Servicing elevation of privilege vulnerability allows a local attacker to make a SYSTEM TiWorker process load an unsigned sibling dpx.dll from a controlled OnePackage metadata directory. The module performs the following steps: Generates a per-run CORE Impact agent DLL named dpx.dll. Copies the target's installed, signed UpdateAgent.dll and builds a reduced DesktopDeployment cabinet with the controlled dpx.dll. Builds a small standalone OnePackage carrier on the target by using the Windows makecab utility. Executes the CBS helper directly from memory without writing the helper executable to the target filesystem. Invokes the public CBS Session COM endpoint and evaluates applicability without staging, installing, or committing the package. Causes UpdateAgent.dll to load the controlled sibling dpx.dll inside TiWorker.exe.

This module exploits CVE-2026-81578, an improper access control vulnerability combined with CVE-2026-82078, an unsafe dynamic class loading vulnerability in the database connection utilities of PaperCut NG and MF to deploy an OSCI agent. The module will use the vulnerability chain via a crafted Apache Tapestry complex-direct request to invoke privileged ConfigEditor components through the public Home page. On version 26 of the affected software, the module reconfigures external user lookup to use an H2 JDBC URL whose initialization SQL evaluates Groovy code. On versions 24 and 25, it uses a bundled Derby procedure to write a temporary Groovy bootstrap class to the application classpath and then loads it as a database driver. Due to the way the vulnerability chain is exploited, the command output cannot be reliably in-band through the existing lookup response, so OSCI agent commands will be marked as blind, meaning that no command output will be returned.

The module authenticates to Configuration Manager AdminService with a low-privileged domain identity and calls UploadExtensionInChunks. The exploit uses an Authenticode-signed CAB to extract a path traversal to place an adsource.dll proxy and a preserved original DLL in the Configuration Manager bin X64 directory. Active Directory System Discovery subsequently loads the proxy in SMS_EXECUTIVE and modifies the built-in RID-500 account as NT AUTHORITY\\SYSTEM. The module then authenticates over SMB with that local administrator and deploys an Impact agent as SYSTEM. An HTTP 500 response can occur after successful CAB extraction and is therefore not treated as definitive failure. The agent callback is the success condition.

ResetNightmare is an authorization flaw in the Microsoft Kerberos Change Password protocol. On an unpatched domain controller, an attacker who can write the userPrincipalName attribute of a controlled account can obtain a kadmin/changepw ticket whose client name identifies another account while its PAC identifies the controlled account. The module temporarily changes the controlled account's UPN to the target sAMAccountName, requests a kadmin/changepw ticket with an NT-ENTERPRISE client name, restores the original UPN, and uses the ticket in an RFC 3244 password-change exchange. The target credentials are verified and stored as an Impact identity by default. The controlled account can be an existing user or computer whose cleartext password is known and whose userPrincipalName can be modified.