CVE-2026-15430

CVE-2026-15430 PUBLISHED

Description (CNA)

Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected security processes.

Affected (CNA)

Vendor / product	Versions
Wellbia / XIGNCODE3	affected 2026.6.1.192

CWE

No CWE identifiers supplied.

References

https://blacksnufkin.github.io/posts/Hunting-the-Hunter-II/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.