VulnSocial

CVE-2026-36425Active Exploitation

HIGHCVSS 6.5 · MEDIUM

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation.

Back to dashboard
7.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 5 classified signals
  • Public PoC and exploit tooling are both present
  • 6 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 5 signals
  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Peaked 2d ago at 3 mentions (2026-08-27); latest day: 1
  • 6 total mentions across 4 days

Deep dive

Activity timeline6 mentions / 4d
01223Mentions · 2026-07-21: 1Mentions · 2026-08-27: 3Mentions · 2026-08-28: 1Mentions · 2026-09-01: 1PoC Mentioned / Linked · 2026-07-21: 1Exploit Tool / Code · 2026-07-21: 1Active Exploitation · 2026-08-27: 3Active Exploitation · 2026-08-28: 1Active Exploitation · 2026-09-01: 1Technical Details · 2026-07-21: 1Technical Details · 2026-08-27: 107-2108-2708-2809-01
Signal classification2 categories
Active Exploitation
583.3%
PoC
116.7%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-07-211
PoC1
2026-08-273
Active Exploitation3
2026-08-281
Active Exploitation1
2026-09-011
Active Exploitation1
Full discourse6 posts
  • The Hacker News@TheHackersNews
    Active Exploitation

    🚨 Spark RAT targets Cambodia using a vulnerable driver to kill security processes. The campaign abuses CVE-2026-36425 in an OPSWAT driver to terminate processes tied to Microsoft Defender, Huorong, and Tencent PC Manager before deploying the RAT. How the attack chain works: https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html

    Post summary

    The post reports that Spark RAT is actively exploiting CVE-2026-36425 to terminate security processes in Cambodia, outlining the attack chain but offering no PoC or patch details.

    1160731633.2K
    2.4M followersView on X
  • Mr. OS@ksg93rd
    PoC

    #exploit #Kernel_Security 1⃣ CVE-2026-36425: OPSWAT AppRemover Arbitrary Process Termination https://github.com/redteamfortress/CVE-2026-36425 2⃣ CVE-2026-31694: Unprivileged root via an out-of-bounds write in the FUSE readdir cache https://cyberstan.co.uk/fuse-readdir-oob // http://www.cyberpocket.org

    Post summary

    Both CVE‑2026‑36425 and CVE‑2026‑31694 are accompanied by publicly available PoC code on GitHub, with concise vulnerability descriptions but no evidence of active exploitation or patches.

    04097493
    3.4K followersView on X
  • hacks.gr@hacksgreece
    Active Exploitation

    Email-παγίδες στην Καμπότζη διανέμουν το Spark RAT, που μπορεί να δώσει απομακρυσμένο έλεγχο και να τερματίσει λογισμικό ασφαλείας μέσω του CVE-2026-36425. Τι γνωρίζουμε → #SparkRAT #CVE202636425 https://hacks.gr/o-efialtis-ton-drivers-pos-oi-chaker-ekmetalleyontai-tin-opswat-gia-na-exoydeterosoyn-to-antivirus-soy/ https://t.co/btckxWIfxD

    Post summary

    Email-based campaigns in Cambodia have deployed Spark RAT to exploit CVE-2026-36425 for remote control and to disable security software.

    0000038
    45 followersView on X
  • Windows Forum@windowsforum
    Active Exploitation

    🚨 SparkRAT is bringing its own vulnerable driver to shut down Defender before taking over. BYOVD remains Windows malware’s favorite “turn it off and on again”—except Defender stays off. https://windowsforum.com/windows-news.4/cve-2026-36425-lets-sparkrat-disable-microsoft-defender.443771/?utm_source=x&utm_medium=social&utm_campaign=news_node4 #WindowsSecurity #ByovdAttacks #MicrosoftDefender #Sparkrat https://t.co/qUtK622pqd

    Post summary

    The tweet reports that SparkRAT is actively exploiting CVE-2026-36425 via a vulnerable driver to disable Microsoft Defender, with no patch or technical details provided.

    0000066
    1.4K followersView on X
  • NeoTeo.com@NeoteoCom
    Active Exploitation

    Spark RAT abrevia CVE-2026-36425 en un driver OPSWAT para matar procesos de Microsoft Defender, Huorong y Tencent PC Manager antes de desplegarse. https://thehackernews.com/2026/08/spark-rat-targets-cambodia-abuses.html

    Post summary

    Spark RAT appears to be actively exploiting CVE-2026-36425 to terminate antivirus processes, but the post lacks PoC details, patch references, or deep technical breakdown.

    00000201
    15.9K followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploited vulnerable OPSWAT driver (CVE-2026-36425) to escalate privileges and disable security tools in Cambodia-focused Spark RAT campaign. DLL sideloading chains bypassed endpoint protections through bring-your-own-vulnerable-driver tactics. #ZeroDay #ThreatIntel 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/spark-rat-cambodia-opswat-driver-2026

    Post summary

    Attackers actively exploited CVE-2026-36425, a vulnerable OPSWAT driver, to elevate privileges and disable security tools in a Spark RAT campaign, using DLL sideloading chains to bypass endpoint protection.

    0000058
    2.0K followersView on X

Explore more

Back to dashboard