https://poc.intelseclab.com/tags/local-privilege-escalation/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-24294-petitpotam-smb-ntlm-reflection-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-24294-petitpotam-smb-ntlm-reflection-lpe/Critical severity — network · CVE-2026-24294 (Microsoft Security Response Center). Status: Weaponized. Affects: Windows Server 2025 (SMB client "arbitrary TCP port" feature). Tags: ntlm-relay, smb, petitpotam, windows-server-2025, local-privilege-escalation, lsass, coercion, impacket.networkCriticalntlm-relaysmbpetitpotamwindows-server-2025local-privilege-escalationlsasscoercionimpackethttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3888-snapd-confine-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3888-snapd-confine-lpe/High severity — binary · CVE-2026-3888. Status: Weaponized. Affects: snapd (snap-confine writable-mimic / systemd-tmpfiles handling). Tags: snapd, snap-confine, linux, local-privilege-escalation, race-condition, systemd-tmpfiles, mount-namespace.binaryHighsnapdsnap-confinelinuxlocal-privilege-escalationrace-conditionsystemd-tmpfilesmount-namespacehttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49417-freebsd-dsp-kernel-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49417-freebsd-dsp-kernel-lpe/High severity — binary · CVE-2026-49417. Status: PoC. Affects: FreeBSD kernel — OSS audio driver (/dev/dsp) buffer allocation / thread-stack recycling. Tags: freebsd, kernel, oss, dev-dsp, kernel-stack-leak, rop, smep-bypass, cr4, local-privilege-escalation, c.binaryHighfreebsdkernelossdev-dspkernel-stack-leakropsmep-bypasscr4local-privilege-escalationchttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49413-freebsd-linuxulator-atsecure-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49413-freebsd-linuxulator-atsecure-lpe/High severity — binary · CVE-2026-49413. Status: PoC. Affects: FreeBSD Linux compatibility layer ("Linuxulator", linux/linux64 kernel module) executing Linux setuid-root binaries under /compat/linux/. Tags: freebsd, linuxulator, at_secure, ld_preload, setuid, local-privilege-escalation, c.binaryHighfreebsdlinuxulatorat_secureld_preloadsetuidlocal-privilege-escalationchttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-24018-forticlient-symlink-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-24018-forticlient-symlink-lpe/High severity — binary · CVE-2026-24018. Status: Weaponized. Affects: Fortinet FortiClientLinux. Tags: forticlient, linux, symlink-following, local-privilege-escalation, setuid, shared-object-injection, vpn-config, cwe-61.binaryHighforticlientlinuxsymlink-followinglocal-privilege-escalationsetuidshared-object-injectionvpn-configcwe-61https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-1880-asus-driverhub-toctou-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-1880-asus-driverhub-toctou-lpe/Medium severity — binary · CVE-2026-1880. Status: PoC. Affects: ASUS DriverHub (driver update utility). Tags: windows, toctou, race-condition, lpe, driverhub, asus, local-privilege-escalation, shellexecute.binaryMediumwindowstoctourace-conditionlpedriverhubasuslocal-privilege-escalationshellexecutehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24072-apache-httpd-ap-expr-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24072-apache-httpd-ap-expr-lpe/Medium severity — web · CVE-2026-24072. Status: PoC. Affects: Apache HTTP Server (httpd). Tags: apache-httpd, mod_rewrite, ap_expr, htaccess, local-privilege-escalation, arbitrary-file-read, information-disclosure, cwe-668.webMediumapache-httpdmod_rewriteap_exprhtaccesslocal-privilege-escalationarbitrary-file-readinformation-disclosurecwe-668https://poc.intelseclab.com/pocs/binary/2026-07-03_systeminformer-phsvc-trusted-host-lpe/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-03_systeminformer-phsvc-trusted-host-lpe/High severity — binary · None assigned as of 2026-07-03. Status: PoC. Affects: System Informer (Process Hacker successor), phsvc helper process. Tags: windows, system-informer, process-hacker, lpe, confused-deputy, alpc, phsvc, authenticode, local-privilege-escalation.binaryHighwindowssystem-informerprocess-hackerlpeconfused-deputyalpcphsvcauthenticodelocal-privilege-escalationhttps://poc.intelseclab.com/pocs/web/2026-05-30_litespeed-user-end-cpanel-plugin-privesc/Sat, 30 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-30_litespeed-user-end-cpanel-plugin-privesc/High severity — web · CVE-2026-48172. Status: Patched. Affects: LiteSpeed cPanel Plugin. Tags: local-privilege-escalation, cPanel, LiteSpeed, symlink, archive-extraction.webHighlocal-privilege-escalationcPanelLiteSpeedsymlinkarchive-extraction