Threat reportVulnerabilityTL-2026-3924
Q2 2026 Vulnerability and Exploit Landscape: Exploited AI-platform flaws (OpenClaw CVE-2026-25253, Dify CVE-2026-41948, Open WebUI CVE-2026-45386), Exchange CVE-2026-45501, and Linux kernel page-cache LPE exploit wave (Copy Fail, Dirty Frag)
Q2 2026 Vulnerability and Exploit Landscape (TL-2026-3924), also tracked as Dirty Frag family, is a high-severity software vulnerability, first published 2026-10-20. It has no confirmed attribution, affects OpenClaw OpenClaw (Clawdbot/Moltbot), references 19 CVEs (CVE-2026-25253, CVE-2026-41948, CVE-2026-45386), maps to 7 MITRE ATT&CK techniques (T1071.001, T1190, T1203), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 19Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-3924
- Threat ID
- TL-2026-3924
- Also known as
- Dirty Frag family, Copy Fail, Nightmare-Eclipse Windows zero-days
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, cloud-services, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Q2 2026 Vulnerability and Exploit Landscape
Malware and tooling: DirtyDecrypt, AdaptixC2, BlueHammer, GreenPlasma, Havoc, RedSun, RoguePlanet, Sliver - S0633, UnDefend, YellowKey, metasploit
How Q2 2026 Vulnerability and Exploit Landscape works
Kaspersky Securelist's Q2 2026 report describes exploitation and public exploits across AI tooling (OpenClaw, Dify, Open WebUI, Langflow), Microsoft Exchange, Windows Defender/BitLocker zero-days released by 'Nightmare Eclipse', and a family of Linux kernel page-cache privilege-escalation flaws (Copy Fail, Dirty Frag, Fragnesia, DirtyDecrypt, PinTheft, pedit COW). Legacy Office and WinRAR CVEs remain the dominant Windows exploit vectors.
Securelist's Q2 2026 vulnerability report (published 2026-08-26) notes unprecedented CVE volume driven by AI-assisted discovery, a sharp rise in critical (CVSS > 9.0) flaws, and a growing practice of publishing working exploits before a CVE is assigned.
AI platforms: OpenClaw (formerly Clawdbot/Moltbot) CVE-2026-25253 (CVSS 8.8, fixed in 2026.1.29 on 2026-01-30) lets the Control UI trust a gatewayUrl query parameter and auto-open a WebSocket that sends the stored gateway token to an attacker-controlled server; with the token an attacker can change sandbox/tool policy, disable confirmation prompts and run commands on the host (one-click RCE), even when the gateway listens on loopback only. Dify CVE-2026-41948 (CVSS 3.1 9.4, versions <= 1.14.1) is a path traversal in BasePluginClient._prepare_request that escapes the tenant path to the Plugin Daemon internal API using '..' or encoded variants; Dify Cloud allows free self-registration so only a victim tenant UUID is needed. Open WebUI CVE-2026-45386 (CVSS 4.3, fixed in 0.9.5) lets read-only users pin/unpin channel messages because only read permission is checked. Securelist reports OpenClaw with 200+ CVEs in Q2 2026 alone and records the first documented APT exploitation of an AI technology (Langflow, attributed in the report to Mirage Kitten). CVE-2026-45501 is a Microsoft Exchange XSS/spoofing flaw (CVSS 6.1) affecting Exchange 2016 CU23, 2019 CU14/CU15 and Subscription Edition.
Linux: the 'Dirty Frag' family abuses page-cache write primitives so an unprivileged user can modify the in-memory copy of a privileged file without changing it on disk. Copy Fail (CVE-2026-31431, crypto subsystem, CVSS 7.8, present since 2017) was disclosed 2026-04-29 and added to CISA KEV on 2026-05-01. Dirty Frag (CVE-2026-43284 xfrm-ESP and CVE-2026-43500 RxRPC) was disclosed 2026-05-08 and needs no user-namespace creation, relying on add_key("rxrpc"), socket(AF_RXRPC) and splice(). Related flaws are Fragnesia (CVE-2026-46300), DirtyDecrypt (CVE-2026-31635), PinTheft (CVE-2026-43494) and pedit COW (CVE-2026-46331, tc-pedit). Because the malicious cache state exists only in RAM, disk-hash integrity checks can miss it. Mitigation is patching or disabling the rxrpc/ESP modules where feasible.
Windows: researcher 'Nightmare Eclipse' published working exploits before CVE assignment: BlueHammer (Defender TOCTOU LPE, later CVE-2026-33825), RedSun (Defender logic flaw), UnDefend (Defender update-blocking DoS), YellowKey (BitLocker bypass via WinRE, physical access), GreenPlasma (CTF loader object injection, partial LPE) and RoguePlanet (Defender TOCTOU enabling wermgr.exe overwrite). Huntress reported in-the-wild use from 2026-04-10 with intrusion activity linked to Russian-geolocated infrastructure. Legacy Equation Editor (CVE-2018-0802, CVE-2017-11882), CVE-2017-0199 and WinRAR flaws (CVE-2023-38831, CVE-2025-6218, CVE-2025-8088) remain the main Windows exploit encounters, although Windows exploit encounters hit an 18-month low. Securelist also lists common APT C2 frameworks (Sliver, Havoc, AdaptixC2, Metasploit) and an observed exploit chain from PeopleSoft CVE-2026-35273 to ActiveMQ CVE-2023-46604 to BeyondTrust CVE-2024-12356/CVE-2026-1731 to WinRAR-based privilege escalation.
No network IOCs (IPs/domains/hashes) are published in the source, so BeaconBeagle correlation was not applicable. CVSS is not stated in the Securelist report; cvss_score is null because this is an aggregate of many CVEs.
MITRE ATT&CK techniques used in TL-2026-3924
Command and Control
T1071.001 Application Layer Protocol: Web Protocols
Initial Access
T1190 Exploit Public-Facing Application
Execution
T1203 Exploitation for Client Execution; T1204.002 User Execution: Malicious File
Credential Access
T1528 Steal Application Access Token
defense-impairment
T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass; T1685 Disable or Modify Tools
Affected products and versions in Q2 2026 Vulnerability and Exploit Landscape
- OpenClaw — OpenClaw (Clawdbot/Moltbot)
Vulnerable versions: < 2026.1.29
Fixed in: 2026.1.29 - Dify — Dify
Vulnerable versions: <= 1.14.1 - Open WebUI — Open WebUI
Vulnerable versions: < 0.9.5
Fixed in: 0.9.5 - Microsoft — Exchange Server
Vulnerable versions: 2016 CU23; 2019 CU14; 2019 CU15; Subscription Edition
Fixed in: June 2026 security update - Linux — Linux kernel
Vulnerable versions: Distributions incl. Ubuntu, RHEL, CentOS Stream, AlmaLinux, Fedora, openSUSE
Fixed in: Vendor-patched kernels - Microsoft — Windows / Microsoft Defender / BitLocker
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016-2025
Fixed in: Defender 4.18.26050.3011+ (BlueHammer)
Remediation for Q2 2026 Vulnerability and Exploit Landscape
Patches
- OpenClaw 2026.1.29
- Open WebUI 0.9.5
- Microsoft Exchange June 2026 security update (CVE-2026-45501)
- Vendor kernel updates for CVE-2026-31431, CVE-2026-43284, CVE-2026-43500, CVE-2026-46300, CVE-2026-31635, CVE-2026-43494, CVE-2026-46331
Immediate actions
- Patch Linux kernels for Copy Fail, Dirty Frag, Fragnesia, DirtyDecrypt, PinTheft and pedit COW; where patching is not possible, disable/blacklist unused rxrpc and xfrm-ESP modules
- Upgrade OpenClaw to 2026.1.29 or later and rotate gateway tokens
- Upgrade Dify beyond 1.14.1 and Open WebUI to 0.9.5 or later
- Apply Microsoft June 2026 Exchange security update for CVE-2026-45501
- Update Microsoft Defender (4.18.26050.3011 or later) and apply April 2026 Windows patches
Workarounds
- Blacklist rxrpc kernel module and restrict IPsec/xfrm where not needed
- Restrict unnecessary local shell access and harden containerized workloads
- Enable BitLocker startup PIN and BIOS password to mitigate YellowKey
- Drop page cache or reboot after suspected Dirty Frag exploitation
Longer-term hardening
- Segment AI platforms (OpenClaw, Dify, Open WebUI, Langflow) from sensitive networks
- Enforce token validation, input sanitization and access-control checks in AI/agent systems
- Review AI-generated code before deployment
- Target 24-48 hour patching for critical vulnerabilities
- Deploy behavioral EDR and monitoring independent of Defender
CVEs associated with Q2 2026 Vulnerability and Exploit Landscape
Weaknesses (CWE) in Q2 2026 Vulnerability and Exploit Landscape
Timeline of Q2 2026 Vulnerability and Exploit Landscape
- OpenClaw 2026.1.29 released, fixing the gatewayUrl token-exfiltration flaw (CVE-2026-25253)
- CVE-2026-25253 one-click RCE publicly disclosed (researcher Mav Levin)
- Huntress confirms in-the-wild use of Nightmare Eclipse Windows exploits, linked to Russian-geolocated infrastructure
- Copy Fail (CVE-2026-31431) publicly disclosed with a reliable public exploit
- CISA adds CVE-2026-31431 to the Known Exploited Vulnerabilities catalog
- Dirty Frag (CVE-2026-43284 and CVE-2026-43500) disclosed before patches were available
- Barracuda documents six Nightmare-Eclipse Windows zero-days released since April 2026
- Securelist publishes the Q2 2026 vulnerability and exploit report
Sources cited for Q2 2026 Vulnerability and Exploit Landscape
- Exploits and vulnerabilities in Q2 2026 (Securelist)
- OpenClaw bug enables one-click remote code execution (The Hacker News)
- OpenClaw auth token theft leading to RCE CVE-2026-25253 (SonicWall)
- Copy Fail (CVE-2026-31431) FAQ (Tenable)
- CVE-2026-43500 and CVE-2026-43284: Dirty Frag analysis (SOC Prime)
- Dirty Frag Linux kernel LPE (XM Cyber)
- Nightmare-Eclipse: six zero-days, six weeks and one big grudge (Barracuda)
- Researchers uncover YellowKey and GreenPlasma Windows zero-days (Security Affairs)
- NVD: CVE-2026-45501 Microsoft Exchange
- NVD: CVE-2026-41948 Dify
- OSV: CVE-2026-45386 Open WebUI
Detection coverage for TL-2026-3924
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3924 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.