CVE•Published 2026-05-12•Modified 2026-06-01•1 article on news•5 live references•NVD data

CVE-2026-40369Microsoft · Windows_11_24h2

Vulnerability data via NVD (ingested)

CVSS v3.1

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS percentile

—

Weaknesses (CWE)

CWE-822Untrusted Pointer Dereference

Description

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Timeline

Published 2026-05-12

Modified 2026-06-01

External references

NVD MITRE Exploit-DB Sploitus VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2026-40369

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · OS

os:"Windows 11 24h2"

Hosts Shodan identified as running Windows 11 24h2.

More intel sources (5)

Shodan report

vuln:CVE-2026-40369

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2026-40369

Censys host search filtered to this CVE id.

grep.app

CVE-2026-40369

Public source-code mentions — fast PoC discovery.

GitHub code

CVE-2026-40369

GitHub code search for direct mentions.

Google dork

"CVE-2026-40369" exploit -site:nvd.nist.gov

Write-ups and news, NVD excluded.

Known PoCs on GitHub (8)

CVE-2026-403698 repos

nomi-sec/PoC-in-GitHubunknown

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

★ 7,844·updated today

gmh5225/awesome-game-securityPython

awesome game security [Welcome to PR]

★ 2,980·updated today

GhostTroops/TOPShell

TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things

★ 731·updated today

orinimron123/CVE-2026-40369-EXPLOITC++

Full exploit code for CVE-2026-40369 - A Windows kernel arbitrary write vulnerability that allows browser sandbox escape from all browsers render process sandbox

★ 248·updated 1mo ago

killvxk/gitweeklyC

收集各种有趣的github项目

★ 90·updated 1d ago

DarkFunct/TK-CVE-RepoPython

TK-CVE-Repo

★ 51·updated 1w ago

patrickmgarrity/Anthropic-Credited-CVEsunknown

Tracking Vulnerabilities That Appear to be Credited to the Anthropic Research Team

★ 23·updated today

holmanholdings/lionguardPython

Cathedral-Grade Security for AI Agents. Attack vectors updated daily. Local-first, zero API cost. MIT licensed.

★ 5·updated 1w ago