CVE-2026-36425
Improper Privilege Management: Is CVE-2026-36425 real, exploitable, or a false positive? Here's the community verdict.
Community verdict: No field verdicts yet. Be the first practitioner to weigh in.
signals
public sources
Reported exploited in the wild (VulnCheck KEV), though not in CISA KEV yet. Treat it as urgent and check your exposure.
public exploits
links to sources — we don’t host codeUnverified proof-of-concept code has been published. It may or may not be functional — assess before relying on it.
baseline read
auto · not a community verdict
Low signal — verdict needed
Few public signals point to active risk. Whether a scanner hit here is a true or false positive depends on your version and config — community verdicts decide.
Based on CVSS · FIRST EPSS
Confirm or dispute →CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2026-36425)<a href="https://www.truepositive.app/cve/CVE-2026-36425"><img src="https://www.truepositive.app/cve/CVE-2026-36425/badge.svg" alt="TruePositive verdict for CVE-2026-36425"></a>Live badge that updates automatically as the community verdict changes.
timeline
- Added to VulnCheck KEV · reported exploited in the wild
- Published by NVD
Score and exploit changes tracked since .
Community ground truth
Be the first practitioner to weigh in
So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.
🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.
In your experience, is this finding real and exploitable?
awaiting field verdictsCurated baseline: A curated baseline from public sources, shown separately from community verdicts.
No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.
Field notes & remediation
Verdicts are the quick signal. Notes are the evidence and fixes behind them.
- 0
Proof-of-concept code is on GitHub. Exploitation has been demonstrated, though it may need adapting to a real target.
Add a field note or remediationoptional
Related CVEs
Same weakness: CWE-269 · Improper Privilege Management.
- CVE-2017-5689CRIT 9.8KEVEPSS 92%
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
- CVE-2021-20021CRIT 9.8KEVEPSS 89%
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
- CVE-2016-0151HIGH 7.8KEVEPSS 63%
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."
- CVE-2020-8655HIGH 7.8KEVEPSS 60%
An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.
- CVE-2019-13272HIGH 7.8KEVEPSS 52%
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
- CVE-2014-3153HIGH 7.8KEVEPSS 37%
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.