#privilege-escalation

A Linux kernel ptrace flaw enables local attackers to exploit a race condition and duplicate privileged file descriptors, exposing sensitive data such as SSH private keys and shadow password files across major distributions.

Source: Orca Security

Two Windows zero-days enable attackers to bypass BitLocker protection during reboot and escalate to SYSTEM privileges through memory object abuse in Windows 11 and Server systems. The flaws, tracked as YellowKey and GreenPlasma, require physical access or local execution but fully compromise system security once triggered.

Source: SecurityWeek | BlackFort TEC | GitHub (Nightmare-Eclipse)

Nine vulnerabilities in Linux's AppArmor security module — present since kernel version 4.11 — allow any unprivileged local user to escalate to root, crash the system, or break out of containers on Ubuntu, Debian, and SUSE systems.

Source: Qualys

A newly disclosed Linux kernel flaw allows attackers to corrupt memory in network processing paths and instantly escalate from local access to full root privileges. The issue affects systems using XFRM ESP-in-TCP handling and can overwrite critical cached data such as /usr/bin/su during exploitation.

Source: Wiz Research | V12 Security

A set of Linux kernel flaws known as Dirty Frag lets attackers escalate privileges to root on major distributions using crafted network and memory operations. Researchers show unprivileged users can abuse kernel components to gain full system control, with patched kernels already released for affected platforms.

Source: CloudLinux | AlmaLinux

A stealthy Linux kernel flaw lets attackers rewrite memory without touching files, giving unprivileged users full root control across major distributions and even enabling container escapes.

Source: Copy Fail | Xint Code

CVE-2026-26119 in Windows Admin Center allowed low-privileged users to gain administrative rights; the vulnerability has been patched in version 2511.

Source: The Hacker News | Microsoft Security Response Center

A Windows Defender race condition exploit dubbed RoguePlanet allows attackers to escalate privileges to SYSTEM on Windows 10 and 11 systems using malicious VHD(X) files over SMB. The proof-of-concept demonstrates reliable local privilege escalation and potential remote code execution paths under certain conditions.

Source: SecurityWeek | GitHub MSNightmare