Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-29 | 1 | Disclosure1 |
| 2026-09-09 | 2 | PoC2 |
| 2026-09-15 | 2 | Exploit2 |
| 2026-09-22 | 2 | Disclosure1PoC1 |
| 2026-09-25 | 3 | PoC3 |
| 2026-10-14 | 1 | Disclosure1 |
PoC and a brief writeup for CVE-2026-49881 (fixed today in 2026 sept ASB) this vulnerability allows one-tap LPE to system_server from an unprivileged app on android 17, and some 16 versions https://github.com/Supersonic/TLPE
Post summary
A proof‑of‑concept and exploit code for CVE‑2026‑49881 has been published, demonstrating a one‑tap LPE on Android 16/17, and the vulnerability was patched in the September 2026 audit‐security bulletin.
🔴 Android 17'de (ve bazı 16 versiyonlarında) kritik LPE açığı için PoC ve write-up yayınlandı. CVE-2026-49881, Telecom servisindeki InCallController mantık hatasından yararlanarak ayrıcalıksız bir uygulamanın kullanıcı etkileşimi olmadan system_server (UID 1000) bağlamında keyfi kod çalıştırmasına olanak sağlıyor. PoC ayrıca elde edilen system_server erişiminin kalıcı hale getirilebildiğini gösteriyor. Açık Eylül 2026 Android Security Bulletin kapsamında yamalandı. https://github.com/Supersonic/TLPE
Post summary
A PoC and write‑up for Android 17’s LPE CVE‑2026‑49881 were released, showing that an unprivileged app can run arbitrary code as system_server and make it persistent; the issue was patched in the September 2026 Android Security Bulletin.
A PoC/exploit has been discovered for vulnerability CVE-2026-49881 PT ID: PT-2026-88244 Vendor: Google Product: Android Description: In serviceClassExists of http://InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. References: • https://dbu.gs/vulnerability/PT-2026-88244 • https://github.com/supersonic/tlpe
Post summary
The post announces a local privilege escalation vulnerability in Android and states that a PoC/exploit has been discovered, with a GitHub link provided. Its primary focus is the availability of exploit code.
[1day1line] CVE-2026-49177: System EoP via Logical Bug in Android InCallController Hello, this is newp1ayer48. Today's 1day1line is System EoP vulnerability caused by a logical bug in the Android InCallController. This vulnerability allows code from a standard app to execute within the `system_server` process—triggered while checking for the existence of a service class—ultimately leading to System-level (uid=1000) EoP. Please refer to the blog post for more details! https://hackyboiz.github.io/2026/10/14/newp1ayer48/CVE-2026-49881/
Post summary
This is a new vulnerability disclosure (1day1line) for CVE-2026-49177, a System EoP in Android InCallController caused by a logical bug, with technical details provided and a link to a blog post for further information.
A critical Android Telecom vulnerability (CVE-2026-49881) allows remote code execution. Read the analysis and learn how to secure your device today. #Android #CVE202649881 #Cybersecurity #Infosec #ZeroDay https://securityonline.info/android-telecom-vulnerability-cve-2026-49881/
Post summary
The tweet discloses a critical Android Telecom vulnerability enabling remote code execution and links to an analysis. It provides vulnerability details but does not explicitly mention a PoC, exploit tool, active exploitation, or specific patch.
Android 17'deki CVE-2026-49881 için PoC/Exploit yayınlandı. Android 17'nin Telecom servisindeki InCallController sınıfında bulunan serviceClassExists() fonksiyonundaki mantık hatası, ayrıcalıksız bir uygulamanın arbitrary code execution gerçekleştirmesine ve yetkilerini yükselterek system_server içerisinde UID 1000 ('system') seviyesinde kod çalıştırmasına olanak sağlıyor. Etkilenen bileşen: Android Telecom / InCallController Etkisi: Local Privilege Escalation + Arbitrary Code Execution Bu açık Eylül 2026 Android Security Bulletin ile yamalandı. https://github.com/supersonic/tlpe
Post summary
A PoC/Exploit for CVE-2026-49881 on Android 17 has been published via a GitHub repository, exploiting a logic error in the InCallController's serviceClassExists() function to achieve local privilege escalation and arbitrary code execution at system_server UID 1000. The vulnerability was patched in the September 2026 Android Security Bulletin.
Android 17の脆弱性 CVE-2026-49881がPoC公開 一般アプリからsystem_serverでコード実行、Googleは9月更新で修正 https://rocket-boys.co.jp/security-measures-lab/android-17-cve-2026-49881-9-update-report/ 『今回の脆弱性は、遠隔から直接Android端末へ侵入するRCEではありません（中略）OS更新に加えて未承認アプリの導入制御も対策になります』
Post summary
The text announces that a PoC for Android 17 CVE-2026-49881 has been released, enabling code execution in system_server from general apps, while noting Google plans to fix it in the September update.
@canyie2977 it got accepted yes, they assigned CVE-2026-49881 a few days ago and i think it’s pending september ASB fix was such a surprising vulnerability 😭
Post summary
The tweet notes the recent assignment of CVE-2026-49881 and an upcoming September patch, but provides no deeper technical or exploit information.
Android 17の端末管理、「修正済み」だけでは落ち着けない。 セキュリティ対策Labによると、CVE-2026-49881のPoCが公開された。一般アプリからsystem_server（UID 1000）で任意コード実行に至ると研究者は報告。root（UID 0）とは別だが、アプリからシステム権限へ届く話は重い。 記事ではGoogleは2026年9月更新で修正したとしている。攻撃はLocalで、9月22日時点の実悪用は確認されていないという。PoC公開と実被害は分けて読みたい。権限昇格に至る仕組みは元記事にある。 私が気になるのは、管理台帳にある各端末の「セキュリティパッチレベル」。修正が出た日と、業務端末に届いた日は、どれだけ離れているだろう。 https://rocket-boys.co.jp/security-measures-lab/android-17-cve-2026-49881-9-update-report/
Post summary
A PoC for CVE-2026-49881 (local arbitrary code execution to system_server) has been published, with Google patching it in the September 2026 update; no active exploitation observed as of September 22.
Android 17の脆弱性 CVE-2026-49881がPoC公開 一般アプリからsystem_serverでコード実行、Googleは9月更新で修正 https://rocket-boys.co.jp/security-measures-lab/android-17-cve-2026-49881-9-update-report/ #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース
Post summary
CVE-2026-49881 for Android 17 has a publicly shared PoC enabling code execution from regular apps to system_server, and Google fixed it in the September update.
Android 17の通話管理に権限昇格の脆弱性「CVE-2026-49881」 — 研究者がPoCを公開、9月更新で修正済み https://cyber.nexsight.co/articles/2026/09/22/android-telecom-cve-2026-49881-tlpe-poc-2026-09-22/
Post summary
The post announces a privilege escalation vulnerability in Android 17 call management, highlights that researchers published a PoC, and notes the issue was fixed in the September update.