April 11 - April 17, 2026

Happy Friday! The Initial Access Intelligence team's deliverables for the past week are below.

CVE-2026-24291: Microsoft Windows Accessibility Infrastructure LPE (RegPwn)

This week, the team developed an exploit for CVE-2026-24291, a Windows local privilege escalation dubbed "RegPwn" by MDSec. The vulnerability arises because Windows Accessibility Infrastructure incorrectly trusts registry configurations. A wide range of Windows versions are vulnerable, and the team's testing confirmed the flaw is easily exploitable — both of which lead us to believe the vulnerability will be exploited in the wild in the future. The team also provided Sigma rules for this vulnerability.

CVE-2026-29059: Windmill Unauthenticated Path Traversal RCE

The team developed an exploit for CVE-2026-29059, a medium-severity path traversal vulnerability discovered by Chocapikk in popular open-source workflow automation platform Windmill. The vulnerable product boasts more than 10 million downloads and is also commonly embedded in Nextcloud Flow, which exposes the vulnerable Windmill endpoints. We covered this vulnerability because it allows unauthenticated attackers to read arbitrary files and achieve remote code execution via an unauthenticated file retrieval endpoint. Our ZoomEye query reports roughly 800 internet-exposed Windmill installations, though that notably doesn't include potential Nextcloud Flow installations (for which queries weren't feasible).

Our exploit comes with a version scanner, PCAPs, ASM queries, a Docker container, and network rules.

CVE-2026-34197: Apache ActiveMQ Classic Jolokia Authenticated RCE

The team developed an exploit for CVE-2026-34197, an improper input validation vulnerability in Apache ActiveMQ classic that allows for authenticated remote code execution over the Jolokia API. Our testing confirmed that exploitation is trivial, and our Shodan query finds nearly 3,000 hosts online. This vulnerability has been exploited in the wild and is on VulnCheck KEV. Our exploit comes with a target Docker container, ASM queries, Suricata and Snort rules, and PCAPs.

CVE-2024-32114: Apache ActiveMQ Classic Jolokia Unauthenticated RCE

In addition to the authenticated variant of this vulnerability (above), the team developed the first known exploit for CVE-2024-32114, which affects older ActiveMQ instances and allows for unauthenticated exploitation of the Jolokia API. The vulnerability isn't known to be exploited at time of writing. Our exploit comes with a target Docker container, ASM queries, Suricata and Snort rules, and PCAPs.

CVE-2026-29014: MetInfo CMS Unauthenticated PHP Code Injection RCE

The team also added an exploit for an unauthenticated PHP code injection vulnerability in MetInfo CMS, an open-source content management system popular in China. Previous MetInfo CMS vulnerabilities include CVE-2025-63551 (XXE/SSRF) and CVE-2025-60450 (stored XSS), neither of which has been found to grant RCE. Our FOFA query finds around 2,000 MetInfo CMS instances on the public internet, with the largest share located in China followed by the United States. Our exploit comes with PCAPs, ASM queries, network signatures, a YARA rule, and a Docker target.

Signatures and PCAPs

The team also added signatures and PCAPs for the following vulnerabilities to improve our detection coverage for VulnCheck KEVs.