CVE-2026-14723 Overview
CVE-2026-14723 is an insecure deserialization vulnerability in AD-Security AD_Miner version 1.9.0. The flaw resides in the request_a function within ad_miner/scripts/analyse_cache.py, part of the Cache Handler component. An attacker who can control the sys.argv[1] argument passed to the script can trigger unsafe deserialization of attacker-supplied data. Exploitation requires local access and low privileges on the host running AD_Miner. The vulnerability is tracked under [CWE-20: Improper Input Validation]. A fix has been proposed via a pull request to the upstream repository but has not yet been merged at the time of publication.
Critical Impact
Local attackers with low privileges can trigger deserialization through a controlled command-line argument, potentially leading to arbitrary code execution in the context of the AD_Miner process.
Affected Products
- AD-Security AD_Miner 1.9.0
- Component: Cache Handler (ad_miner/scripts/analyse_cache.py)
- Function: request_a
Discovery Timeline
- 2026-07-05 - CVE-2026-14723 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-14723
Vulnerability Analysis
AD_Miner is an open-source Active Directory security analysis tool that processes cached Neo4j query results. The analyse_cache.py script accepts a file path or identifier through sys.argv[1] and passes it into the request_a function without validating the trust boundary of the input. The function then deserializes cache contents, which allows attacker-controlled data to be reconstructed into Python objects.
When unsafe deserialization primitives such as pickle.load process attacker-influenced input, arbitrary object constructors can be invoked during reconstruction. This turns a data-parsing operation into a code execution primitive within the AD_Miner runtime.
Exploitation is constrained to local attackers with existing low-privilege access. Successful abuse impacts confidentiality, integrity, and availability of the process context that runs AD_Miner, typically an analyst workstation or an Active Directory audit host.
Root Cause
The root cause is improper input validation ([CWE-20]) combined with deserialization of untrusted data. The request_a function trusts that the file referenced by sys.argv[1] is a legitimate cache artifact produced by AD_Miner itself. No integrity check, signature verification, or safe-loader is applied before the object graph is reconstructed.
Attack Vector
An attacker with local access places a crafted cache file on disk in a location the AD_Miner user will read from, or convinces that user to run analyse_cache.py with a path pointing to the malicious file. When the script executes, the deserializer instantiates attacker-defined objects, executing embedded gadgets during unpickling. Because AD_Miner is frequently run by administrators auditing Active Directory, code execution in that context can yield high-value privileges and access to AD reconnaissance data. See the upstream discussion in AD_Miner Issue #238 and the proposed fix in Pull Request #239.
Detection Methods for CVE-2026-14723
Indicators of Compromise
- Unexpected cache files in AD_Miner working directories that were not generated by a prior legitimate scan.
- Invocation of analyse_cache.py with a sys.argv[1] value pointing to a path outside the standard AD_Miner cache directory.
- Child processes spawned from the Python interpreter running AD_Miner that perform reconnaissance, credential access, or outbound network activity.
Detection Strategies
- Monitor process creation events where python or python3 executes ad_miner/scripts/analyse_cache.py and log the full command line, including argument values.
- Alert on file writes to AD_Miner cache paths originating from processes other than AD_Miner itself.
- Correlate execution of analyse_cache.py with subsequent spawning of shells (cmd.exe, powershell.exe, /bin/sh, /bin/bash) from the same parent Python process.
Monitoring Recommendations
- Enable command-line auditing on hosts used for Active Directory assessments and forward events to a centralized log platform.
- Track integrity of files in the AD_Miner installation and cache directories with file integrity monitoring.
- Review scheduled tasks or automation pipelines that call analyse_cache.py and confirm the input file source is trusted.
How to Mitigate CVE-2026-14723
Immediate Actions Required
- Restrict execution of AD_Miner 1.9.0 to trusted operators and trusted cache files only.
- Do not run analyse_cache.py against cache files received from untrusted users, shared directories, or externally sourced archives.
- Apply strict filesystem permissions on AD_Miner cache directories so only the intended user account can write to them.
Patch Information
At the time of publication, the fix is proposed in AD_Miner Pull Request #239 and awaits acceptance by the maintainers. Track merge status in the AD_Miner repository and upgrade to the first release that includes the merged fix. Additional context is available in the VulDB entry for CVE-2026-14723.
Workarounds
- Run AD_Miner inside an isolated virtual machine or container dedicated to AD auditing to limit blast radius if deserialization is triggered.
- Manually validate that any cache file passed to analyse_cache.py was produced by the current user during a controlled AD_Miner run.
- Replace unsafe deserialization in local forks with a safe loader or a signed cache format until the upstream patch is available.
- Remove or disable analyse_cache.py on operator workstations that do not require cache post-processing.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
