Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll Control_RunDLL input.dll. Attackers can place a malicious executable earlier in the search order to achieve arbitrary code execution in the context of the affected user.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-17 | 2 | Disclosure2 |
| 2026-06-18 | 4 | Disclosure4 |
| 2026-07-10 | 1 | General1 |
| 2026-07-17 | 1 | Disclosure1 |
| 2026-08-03 | 1 | General1 |
| 2026-09-25 | 1 | Disclosure1 |
| 2026-10-09 | 1 | Disclosure1 |
A signed binary. Clean on VirusTotal. Clean on every file scanner. It also carries a CVE with no patch. CVE-2026-25865 in Punto Switcher only surfaced because our sensor watched it run.
Post summary
The sample is a clean binary that contains the unpatched CVE‑2026‑25865 in Punto Switcher, discovered solely by sensor monitoring.
CVE-2026-25865 Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the applic… https://www.cve.org/CVERecord?id=CVE-2026-25865
Post summary
The text provides a brief disclosure of CVE‑2026‑25865, describing an unquoted search path element flaw in Punto Switcher that permits local code execution.
A 120-day disclosure window can close with total silence on the other end. This one did. No patch is coming, so we published CVE-2026-25865 anyway. Sitting on a flaw only protects the next attacker who finds it. Defenders get to mitigate. https://spektion.com/videos https://t.co/5JirLVSqXK
Post summary
The text describes the public disclosure of CVE-2026-25865 after a 120-day window expired without a vendor patch, providing a link to a video demonstration of the issue.
July's other two signals: Punto Switcher calls rundll32.exe with no path. CVE-2026-25865, CVSS 8.5, no patch. File scanners call the signed binary clean. OpenAI Codex shipped 555 releases this year. Firefox shipped 25.
Post summary
The post simply notes CVE-2026-25865 has a CVSS score of 8.5 and no patch is available, offering no further exploitation or mitigation details.
A signed binary is not a safe one. Punto Switcher launches rundll32.exe without saying where to load it from. Drop a matching file beside it and the allowlisted app runs attacker code. Scanners call it clean. CVE-2026-25865, no patch. https://spektion.com/videos https://t.co/QkA0UxGNHk
Post summary
CVE‑2026‑25865 enables attackers to execute code by dropping a matching file next to a signed binary that launches rundll32.exe, with scanners missing the flaw and no patch available.
Last week we said CVE scanning is signature AV in a new suit. Here's a real one we just disclosed. CVE-2026-25865: a signed Windows binary, nothing wrong on disk, RCE in a call it only makes at launch. No catalog-model scanner was going to flag it. We caught it at runtime.
Post summary
The author disclosed a newly identified CVE-2026-25865, a Windows binary Remote Code Execution flaw that triggers on launch and evades signature scanning.
Spektion Research disclosure: CVE-2026-25865, an unquoted-path flaw in Punto Switcher that runs attacker-placed code at the user's privilege level. A file scanner would never flag it. The reason is the whole point.
Post summary
The post discloses CVE-2026-25865, an unquoted-path vulnerability in Punto Switcher that permits execution of attacker-controlled code at the user’s privilege level, but it does not provide a PoC, patch, or evidence of active exploitation.
Punto Switcher asks Windows for rundll32.exe and never says where it lives. Windows checks the app's own folder first. One planted file with the right name, and a signed app runs it. CVE-2026-25865, no fix on record. https://spektion.com/videos?utm_source=x&utm_medium=organic_company&utm_campaign=punto-short-5-which-rundll32 https://t.co/I0tyl0Asp4
Post summary
The post describes a DLL search-order issue in Punto Switcher and says there is no fix on record. It provides technical details but does not report active exploitation or explicitly identify the linked video as a PoC.
CVE-2026-25865 Arbitrary Code Execution via Unquoted Search Path in Punt... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25865 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet references CVE‑2026‑25865 with a brief title and links to vulnerability details, but provides no PoC, exploit code, active exploitation, patch, or false‑positive claim.
🚨*CVE* CVE-2026-25865 Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the applic… https://www.cve.org/CVERecord?id=CVE-2026-25865 ----- Traducción: CVE-2026-25865 Pun… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026‑25865, highlighting an unquoted search path element vulnerability in Punto Switcher that can lead to local code execution, without providing PoC, exploit, patch, or false‑positive information.
How do you catch a vulnerability that is not on disk? Our Punto Switcher disclosure (CVE-2026-25865) is a signed binary with a flaw that only exists at runtime. David Westcott and Josh Skorich will break it down. Up on demand later this month: https://spektion.com/videos
Post summary
The text announces the disclosure of CVE-2026-25865 for Punto Switcher, noting a signed binary flaw that manifests only at runtime, with no PoC, patch, or exploitation details provided.