Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 15 products
| Date | Total | Labels |
|---|
| 2026-02-19 | 2 | Exploit1PoC1 |
| 2026-02-20 | 3 | Disclosure2General1 |
| 2026-02-24 | 1 | Disclosure1 |
| 2026-02-27 | 1 | Patch1 |
| 2026-03-01 | 1 | Patch1 |
| 2026-03-15 | 2 | PoC2 |
| 2026-03-16 | 2 | PoC2 |
| 2026-03-17 | 2 | Exploit1PoC1 |
| 2026-03-22 | 1 | General1 |
| 2026-07-21 | 1 | Patch1 |
| 2026-07-30 | 1 | Patch1 |
Researcher releases PoC exploit code for EventLogin, a TOCTOU flaw in Windows MS-EVEN RPC allowing remote file writes. Patch now. https://securityonline.info/poc-disclosed-eventlogin-windows-ms-even-rpc-cve-2025-29969/ https://t.co/xbpnKuBqA5
Post summary
A researcher shared proof‑of‑concept exploit code for CVE‑2025‑29969—a TOCTOU flaw in Windows MS‑EVE RPC that permits remote file writes—and a patch is now available.
New blog & exploit about CVE-2025-29969 - RCE by Yarin Aharoni @safebreach Labs. Findings allow: ---- * Checking arbitrary paths existence (unfixed!). * Writing files remotely (RCE). ---- On ALL Windows & Windows Server computers in the domain! Repo - https://github.com/SafeBreach-Labs/EventLogin-CVE-2025-29969
Post summary
The post announces CVE-2025-29969, a Windows RCE vulnerability, with a PoC and functional exploit code on GitHub, detailing path checks and remote file writes, but does not report active exploitation.
PoC Exploit Disclosed: Researcher Unveils Windows MS-EVEN RPC Vulnerability - https://securityonline.info/poc-disclosed-eventlogin-windows-ms-even-rpc-cve-2025-29969/
Post summary
The post announces that a PoC exploit for CVE‑2025‑29969, a Windows MS‑EVEN RPC vulnerability, has been disclosed.
EventLogin — CVE-2025-29969 A flaw in the MS-EVEN protocol. Low-privileged users can write arbitrary files to a remote machine, effectively bypassing the need for an administrator account for remote file writes 🔗 Source: https://github.com/SafeBreach-Labs/EventLogin-CVE-2025-29969 🔗 Research: https://www.safebreach.com/blog/safebreach_labs_discovers_cve-2025-29969/ #ad #windows #eventlog #rpc
Post summary
SafeBreach Labs disclosed CVE‑2025‑29969, a flaw in the MS‑EVEN protocol that allows low‑privileged users to remotely write arbitrary files, and provided a proof‑of‑concept repository on GitHub.
When I saw the CVE-2025-29969 fix (by @safebreach), I knew there was more to it. It's not as critical as it seems, but it was fun trying to find a way to still exploit this EventLog RPC endpoint
Post summary
The post notes a published fix for CVE-2025-29969 by @safebreach, indicates the issue is less critical, and mentions ongoing attempts to exploit the EventLog RPC endpoint.
Microsoft : "on a bien patché la CVE-2025-29969" @HackAndDo : "hold my beer" Microsoft : "😮" Pour les détails, c'est sur le blog de Login Sécurité : https://login-securite.com/blog/cve-2026-50502-rce-via-le-service-windows-event-log-elfrbackupelfw
Post summary
Microsoft confirms it has patched CVE-2025-29969; a blog provides technical details on CVE-2026-50502, an RCE vulnerability via the Windows Event Log.
EventLog-in: Propagating With Weak Credentials Using the Eventlog Service in Microsoft Windows (CVE-2025-29969) https://www.safebreach.com/blog/safebreach_labs_discovers_cve-2025-29969/
Post summary
The article announces CVE-2025-29969, describing how weak credentials can be exploited via the Windows Eventlog service, but it does not provide PoC, exploit code, patch information, or evidence of active exploitation.
EventLog-in: Propagating With Weak Credentials Using the Eventlog Service in Microsoft Windows (CVE-2025-29969) http://dlvr.it/TRdh5p #cyber #threathunting #infosec
Post summary
The post references CVE‑2025‑29969, describing a weakness involving weak credentials via the Windows Eventlog service, but offers no PoC, exploit code, patch information, or evidence of active exploitation.
Discovery & Analysis of CVE-2025-29969 https://www.safebreach.com/blog/safebreach_labs_discovers_cve-2025-29969/
Post summary
The post announces the discovery and analysis of CVE-2025-29969 but does not provide additional details on PoC, exploit availability, active exploitation, patch, or technical specifics.
although patched May last year , you might get lucky https://github.com/SafeBreach-Labs/EventLogin-CVE-2025-29969
Post summary
A tweet points to a GitHub repo that appears to host a proof‑of‑concept for CVE‑2025‑29969, noting the issue was patched in May; no evidence of active exploitation or detailed vulnerability data is provided.
@al3x_n3ff You can also now weaponize the cve-2025-29969 ;)), good stuff as always! Love it!
Post summary
The message indicates that CVE-2025-29969 can be weaponized, implying the availability of an exploit, but it does not provide any explicit exploit code, tool, patch information, or detailed technical details about the vulnerability.
CVE-2025-29969 is a remote code execution vulnerability in MS-EVEN RPC protocol on Windows 11 and Windows Server 2025, letting low-privileged users write files remotely. #cybersecurity #vulnerability
Post summary
The post announces CVE‑2025‑29969 as a remote code execution flaw in the MS‑EVEN RPC protocol affecting Windows 11 and Server 2025, enabling low‑privileged users to write files remotely.
PoC Exploit Disclosed: Researcher Unveils Windows MS-EVEN RPC Vulnerability https://securityonline.info/poc-disclosed-eventlogin-windows-ms-even-rpc-cve-2025-29969/
Post summary
A researcher disclosed a proof‑of‑concept exploit for the Windows MS‑EVEN RPC vulnerability (CVE‑2025‑29969), but no details on active exploitation, patches, or technical specifics are provided.
SafeBreach Labs found CVE-2025-29969. This high-severity heap-based buffer overflow allows unauthenticated RCE in Trend Micro Apex One and Worry-Free Business Security products. Patches have been released. PS: Visit olivermaicher[.]eu
Post summary
SafeBreach Labs identified a high‑severity heap‑based buffer overflow (CVE‑2025‑29969) in Trend Micro Apex One and Worry‑Free Business Security, enabling unauthenticated RCE; patches have been released.
SafeBreach discovered CVE-2025-29969 in Microsoft Azure Site Recovery agent. This allows Local Privilege Escalation by loading a malicious DLL with SYSTEM privileges. Microsoft patched the flaw in June 2024. Update your ASR agents.
Post summary
SafeBreach identified a local privilege escalation vulnerability (CVE-2025-29969) in Azure Site Recovery agents; Microsoft has patched it, and users should update their agents promptly.
Discovery & Analysis of CVE-2025-29969 https://www.safebreach.com/blog/safebreach_labs_discovers_cve-2025-29969/ https://t.co/hNltLVY1wW
Post summary
Safebreach Labs has announced the discovery and analysis of CVE-2025-29969 through a blog post, without providing further technical details or exploit information.
EventLog-in: Propagating With Weak Credentials Using the Eventlog Service in Microsoft Windows (CVE-2025-29969) https://www.safebreach.com/blog/safebreach_labs_discovers_cve-2025-29969/ https://github.com/SafeBreach-Labs/EventLogin-CVE-2025-29969
Post summary
Safebreach Labs has disclosed CVE‑2025‑29969, a weak‑credential flaw in Windows Eventlog, and provided a Proof of Concept on GitHub, with no indication of active exploits or available patches.
27 of 27 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | microsoft | windows_10_1507 | - | - | x64 |
| OS | microsoft | windows_10_1507 | - | - | x86 |
| OS | microsoft | windows_10_1607 | - | - | x64 |
| OS | microsoft | windows_10_1607 | - | - | x86 |
| OS | microsoft | windows_10_1809 | - | - | x64 |
| OS | microsoft | windows_10_1809 | - | - | x86 |
| OS | microsoft | windows_10_21h2 | - | - | arm64 |
| OS | microsoft | windows_10_21h2 | - | - | x64 |
| OS | microsoft | windows_10_21h2 | - | - | x86 |
| OS | microsoft | windows_10_22h2 | - | - | arm64 |
| OS | microsoft | windows_10_22h2 | - | - | x64 |
| OS | microsoft | windows_10_22h2 | - | - | x86 |
| OS | microsoft | windows_11_22h2 | - | - | arm64 |
| OS | microsoft | windows_11_22h2 | - | - | x64 |
| OS | microsoft | windows_11_23h2 | - | - | arm64 |
| OS | microsoft | windows_11_23h2 | - | - | x64 |
| OS | microsoft | windows_11_24h2 | - | - | arm64 |
| OS | microsoft | windows_11_24h2 | - | - | x64 |
| OS | microsoft | windows_server_2008 | - | - | - |
| OS | microsoft | windows_server_2008 | r2 | - | x64 |
| OS | microsoft | windows_server_2012 | - | - | - |
| OS | microsoft | windows_server_2012 | r2 | - | - |
| OS | microsoft | windows_server_2016 | - | - | - |
| OS | microsoft | windows_server_2019 | - | - | - |
| OS | microsoft | windows_server_2022 | - | - | - |
| OS | microsoft | windows_server_2022_23h2 | - | - | - |
| OS | microsoft | windows_server_2025 | - | - | - |