SYSTEM-Shell — PoC Archivehttps://poc.intelseclab.com/tags/system-shell/Latest proof-of-concept entries.Hugoen-usWed, 10 Jun 2026 00:00:00 +0000RoguePlanet — Windows Defender LPE via ISO Mount + Task Scheduler Race Conditionhttps://poc.intelseclab.com/pocs/binary/2026-06-10_rogueplanet-defender-lpe/Wed, 10 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-10_rogueplanet-defender-lpe/High severity (CVSS 7.8) — binary · CVE-2026-50656. Status: Weaponized. Affects: Microsoft Windows Defender / Windows Error Reporting Task Scheduler. Tags: LPE, Windows Defender, race-condition, TOCTOU, ISO-mount, VirtualDisk, Task-Scheduler, WER, EICAR, SYSTEM-shell, Windows-10, Windows-11, local.binaryHighLPEWindows Defenderrace-conditionTOCTOUISO-mountVirtualDiskTask-SchedulerWEREICARSYSTEM-shellWindows-10Windows-11localMiniPlasma - Windows Cloud Files Mini Filter Driver LPE (CVE-2020-17103)https://poc.intelseclab.com/pocs/binary/2026-05-15_miniplasma-cve-2020-17103/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-15_miniplasma-cve-2020-17103/High severity (CVSS 7.8) — binary · CVE-2020-17103. Status: Weaponized. Affects: Windows Cloud Files Mini Filter Driver (cldflt.sys) / cldapi.dll. Tags: LPE, Windows, cldflt.sys, Cloud Files API, registry-symlink, race-condition, WER-hijack, SYSTEM-shell, local-user.binaryHighLPEWindowscldflt.sysCloud Files APIregistry-symlinkrace-conditionWER-hijackSYSTEM-shelllocal-user