cyber.hendryadrian.com
Security Report · securelist.com

Kaspersky Reports Rising Vulnerability Disclosures and Early Exploit Releases in Q2 2026

· Original article ↗

Summary

Kaspersky’s Q2 2026 analysis reports rising vulnerability disclosures, more exploits published before patches, active exploitation of Linux privilege-escalation flaws, and growing vulnerabilities in AI tools.

Key points

  • Kaspersky says vulnerability disclosures and critical vulnerabilities rose sharply in Q2 2026, with AI-assisted vulnerability research contributing to the increase.
  • Researchers published working exploits for several Windows vulnerabilities before CVE registration or patches, including flaws in Windows Defender and BitLocker recovery.
  • Linux kernel vulnerabilities in the Dirty Frag family and related issues enabled local privilege escalation; Kaspersky recommends prompt patching or disabling vulnerable modules when patches are unavailable.
  • Kaspersky telemetry showed a slight decline in Windows and Linux users encountering exploits compared with Q1; Windows reached an 18-month low.
  • The report describes fake, AI-generated Exchange and SharePoint vulnerability research intended to mislead researchers, sometimes distributed with unrelated malware.
  • Kaspersky observed APT attacks exploiting newly published vulnerabilities and highlighted attacks involving Langflow; it also listed C2 frameworks and vulnerabilities used in related attacks.
  • The report notes growing vulnerability counts in AI tools, including access-control and injection issues, and details security flaws in OpenClaw, Dify, and Open WebUI.

Article Details

Publisher
Securelist (Kaspersky)
Report Period
Q2 2026
Scope
Registered vulnerabilities, vulnerability exploitation, APT attacks, C2 framework use, and vulnerabilities in AI/LLM tools.
Key Statistics
  • OpenClaw ranked 12th among projects with the most vulnerabilities published in Q2 2026, with over 200 CVEs registered during the reporting period.
  • The number of Windows users encountering exploits reached an 18-month low in Q2 2026.
  • The number of Linux users encountering exploits declined slightly in Q2 2026 compared with Q1.
Recommendations
  • Install patches as quickly as possible; if patching Linux vulnerabilities is not an option, disable vulnerable kernel modules.
  • Develop secure procedures for credential use and sensitive-data handling in systems that rely on AI agents and LLMs.
  • Use real-time monitoring and access controls, alongside patch management, to track system health and reduce compromise risk.

CVE

CVE-2017-0199CVE-2017-0199: a vulnerability in Microsoft Office and WordPad that allows an attacker to gain control over the systemCVE-2017-11882CVE-2017-11882: another RCE vulnerability also affecting Equation EditorCVE-2018-0802CVE-2018-0802: a remote code execution (RCE) vulnerability in the Equation Editor componentCVE-2019-13272CVE-2019-13272: a vulnerability caused by improper handling of privilege inheritance, which can be exploited to achieve privilege escalationCVE-2021-22555CVE-2021-22555: a heap out-of-bounds write vulnerability in the Netfilter kernel subsystemCVE-2022-0847CVE-2022-0847: a vulnerability known as Dirty Pipe, which enables privilege escalation and the hijacking of running applicationsCVE-2023-32233CVE-2023-32233: another Netfilter subsystem vulnerability that allows for Use-After-Free conditions and privilege escalation through improper processing of network requestsCVE-2023-36884CVE-2023-36884: a vulnerability in the Windows Search component that allows commands to be run on the system, bypassing the mark-of-the-web (MoTW) mechanismCVE-2023-38831CVE-2023-38831: a vulnerability in WinRAR that involves improper handling of objects within an archiveCVE-2023-46604CVE-2023-46604: an insecure deserialization vulnerability in Apache ActiveMQ that allows arbitrary code execution in the context of the service processCVE-2024-12356CVE-2024-12356 and CVE-2026-1731: command injection vulnerabilities in BeyondTrust software that allow an attacker to send malicious commands even without system authenticationCVE-2025-53770CVE-2025-53770: an insecure deserialization vulnerability in Microsoft SharePoint that allows for unauthenticated command execution on the serverCVE-2025-6218CVE-2025-6218 (formerly ZDI-CAN-27198): another WinRAR vulnerability allowing the specification of relative paths to extract files into arbitrary directories, potentially leading to malicious command executionCVE-2025-8088CVE-2025-8088: a vulnerability similar in exploitation method to CVE-2025-6218.CVE-2026-1731CVE-2024-12356 and CVE-2026-1731: command injection vulnerabilities in BeyondTrust software that allow an attacker to send malicious commands even without system authenticationCVE-2026-25253CVE-2026-25253: a gatewayUrl vulnerability in OpenClawCVE-2026-31431CVE-2026-31431 (Copy Fail): a local privilege escalation vulnerability in the Linux kernel that lets an unprivileged user modify the page cache and gain root privileges.CVE-2026-31635CVE-2026-31635 (DirtyDecrypt): a Linux kernel vulnerability that lets a local attacker escalate privileges due to improper handling of decryption operations and page cache data modificationCVE-2026-35273CVE-2026-35273: a vulnerability in Oracle PeopleSoft PeopleTools that security vendors classify as server-side request forgery (SSRF).CVE-2026-41948CVE-2026-41948: a path traversal vulnerability in the Dify AI platformCVE-2026-43284CVE-2026-43284, CVE-2026-43500 (Dirty Frag): a family of vulnerabilities in the Linux networking subsystem (IPsec ESP and RxRPC) that lets a local user overwrite the page cache and escalate privileges to rootCVE-2026-43494CVE-2026-43494 (PinTheft): a Linux kernel vulnerability that lets a local user gain elevated privileges due to errors in the memory page pinning mechanismCVE-2026-43500CVE-2026-43284, CVE-2026-43500 (Dirty Frag): a family of vulnerabilities in the Linux networking subsystem (IPsec ESP and RxRPC) that lets a local user overwrite the page cache and escalate privileges to rootCVE-2026-45386CVE-2026-45386: an improper access control vulnerability in Open WebUICVE-2026-45501CVE-2026-45501: a vulnerability in Microsoft ExchangeCVE-2026-46300CVE-2026-46300 (Fragnesia): a local privilege escalation vulnerability in the Linux kernel related to packet fragment handling and the page cache mechanism.CVE-2026-46331CVE-2026-46331 (pedit COW): a vulnerability in the Linux kernel’s traffic control subsystem (tc-pedit) that exploits a flaw in copy-on-write to modify the page cache and subsequently escalate privileges to root

People

Chaotic EclipseName also used by researcher Nightmare Eclipse, according to the article.Nightmare EclipseResearcher who published a list of newly named vulnerabilities across Windows subsystems; the article states this researcher is also known as Chaotic Eclipse.

Vendors

KasperskyThe data comes from Kaspersky’s vulnerability knowledge base, which draws on the CVE database as well as the Russian BDU database and GitHub Advisory (GHSA).MicrosoftCVE-2017-0199: a vulnerability in Microsoft Office and WordPad that allows an attacker to gain control over the system

Products

Apache ActiveMQCVE-2023-46604: an insecure deserialization vulnerability in Apache ActiveMQ that allows arbitrary code execution in the context of the service processBeyondTrustCVE-2024-12356 and CVE-2026-1731: command injection vulnerabilities in BeyondTrust software that allow an attacker to send malicious commands even without system authenticationBitLockerYellowKey: a vulnerability that lets the user bypass BitLocker full-disk encryption and access system data through the Windows Recovery Environment (WinRE).DifyCVE-2026-41948: a path traversal vulnerability in the Dify AI platformLangflowThe Langflow vulnerability deserves particular attention: it’s one of the first cases of an APT group exploiting AI technology, which many organizations are only just beginning to integrate.LinuxThis resulted in entire new classes of vulnerabilities emerging, particularly in the Linux networking subsystem.Microsoft Exchange ServerIt’s worth noting that while several vulnerability write-ups for Exchange and SharePoint were published during the quarter, most turned out to be fake, AI-generated research.Microsoft SharePointFor instance, we’re once again seeing exploits targeting SharePoint.Microsoft WindowsWindows and Linux vulnerability exploitationOpen WebUICVE-2026-45386: an improper access control vulnerability in Open WebUIOpenClawFor example, OpenClaw, a popular AI project, ranked 12th among those with the highest number of vulnerabilities discovered and published in Q2, with over 200 CVEs registered during the reporting period.Oracle PeopleSoft PeopleToolsCVE-2026-35273: a vulnerability in Oracle PeopleSoft PeopleTools that security vendors classify as server-side request forgery (SSRF).Windows DefenderBlueHammer: a local privilege escalation vulnerability in Windows Defender.WinRARCVE-2023-38831: a vulnerability in WinRAR that involves improper handling of objects within an archiveWinREYellowKey: a vulnerability that lets the user bypass BitLocker full-disk encryption and access system data through the Windows Recovery Environment (WinRE).

Tools

AdaptixC2Sliver, Havoc, AdaptixC2, and Metasploit remain the most widely used C2 frameworks.HavocSliver, Havoc, AdaptixC2, and Metasploit remain the most widely used C2 frameworks.Metasploit FrameworkSliver, Havoc, AdaptixC2, and Metasploit remain the most widely used C2 frameworks.SliverSliver, Havoc, AdaptixC2, and Metasploit remain the most widely used C2 frameworks.

Related Articles