CVE-2026-15430: XIGNCODE3 Privilege Escalation Vulnerability

CVE-2026-15430 Overview

CVE-2026-15430 is an improper access control vulnerability in the Wellbia XIGNCODE3 anti-cheat driver xhunter2.sys, version 2026.6.1.192. The flaw resides in the IRP_MJ_WRITE command interface, which fails to restrict access to privileged driver functionality. A local, unprivileged attacker can invoke the interface to escalate privileges to NT AUTHORITY\SYSTEM. Attackers can also extract credentials from the Protected Process Light (PPL) protected lsass.exe process and terminate PPL-protected security processes. The weakness is classified under [CWE-269: Improper Privilege Management].

Critical Impact
Local, unprivileged users can obtain SYSTEM privileges, dump LSASS credentials, and disable PPL-protected endpoint security processes on hosts running the vulnerable driver.

Affected Products

Wellbia XIGNCODE3 anti-cheat solution
xhunter2.sys kernel driver, version 2026.6.1.192
Windows systems where the vulnerable driver is loaded

Discovery Timeline

2026-08-03 - CVE-2026-15430 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-15430

Vulnerability Analysis

The xhunter2.sys driver exposes an IRP_MJ_WRITE handler that processes commands from user-mode callers without verifying the caller's privilege level or integrity. Because the driver runs in kernel mode, any operation it performs on behalf of a caller executes with full kernel authority. The handler accepts commands that translate into arbitrary kernel-mode primitives, allowing local users to bypass Windows privilege boundaries.

The driver is a signed anti-cheat component, so exploitation does not require loading unsigned code. Attackers with local access can open a handle to the device object and issue write requests to reach the vulnerable code path. External research documenting this class of abuse is available in the Hunting the Hunter II analysis.

Root Cause

The root cause is missing access control on the driver's device object and command dispatch logic. The IRP_MJ_WRITE handler does not validate the security context of the caller, does not restrict which commands unprivileged callers may issue, and does not check whether the target process is PPL-protected. This allows write-level kernel primitives to be reached from a medium integrity user process.

Attack Vector

Exploitation requires local access and no prior authentication. An attacker opens a handle to the xhunter2 device, issues crafted WriteFile calls that encode privileged commands, and uses the resulting kernel primitives to manipulate process tokens or memory. Token swapping against a SYSTEM process yields code execution as NT AUTHORITY\SYSTEM. The same primitives enable reading protected memory in lsass.exe to harvest credentials and terminating PPL-protected antivirus and EDR processes.

No verified proof-of-concept code has been published. See the Hunting the Hunter II write-up for technical background on abusing this driver family.

Detection Methods for CVE-2026-15430

Indicators of Compromise

Presence of xhunter2.sys version 2026.6.1.192 loaded on systems where XIGNCODE3-protected games are not installed or expected
Handles opened to the xhunter2 device object by processes unrelated to protected game clients
Unexpected termination of PPL-protected security processes such as MsMpEng.exe or vendor EDR agents
Access to lsass.exe memory originating from kernel-mode following interaction with the driver

Detection Strategies

Hunt for non-gaming processes issuing CreateFile against \\.\xhunter2 followed by WriteFile calls
Alert on driver load events for xhunter2.sys on servers, developer workstations, or systems outside gaming use cases
Correlate token modification events on user processes with recent activity involving vulnerable third-party drivers

Monitoring Recommendations

Enable kernel driver load auditing via Windows Event ID 6 (Sysmon) and review loads of xhunter2.sys
Monitor for process termination of protected security services and unexpected LSASS handle activity
Track integrity-level transitions where a medium integrity process spawns a SYSTEM child

How to Mitigate CVE-2026-15430

Immediate Actions Required

Uninstall XIGNCODE3 and remove xhunter2.sys from systems where the associated protected application is not required
Add xhunter2.sys version 2026.6.1.192 to the Microsoft Vulnerable Driver Blocklist policy
Restrict local logon rights on systems where the driver must remain installed
Verify PPL-protected security processes are running and alert on their termination

Patch Information

At the time of publication, no vendor advisory or patched driver version has been listed in the NVD entry for CVE-2026-15430. Administrators should monitor Wellbia communications for an updated xhunter2.sys build that enforces access control on the IRP_MJ_WRITE interface.

Workarounds

Deploy Windows Defender Application Control (WDAC) with the Microsoft recommended driver block rules to prevent loading of the vulnerable xhunter2.sys version
Remove the driver service registry entry and delete the driver file on hosts that do not require XIGNCODE3
Limit interactive local access to trusted users on any host where the driver remains installed

bash

# Query and remove the xhunter2 driver service on Windows
sc.exe query xhunter2
sc.exe stop xhunter2
sc.exe delete xhunter2
# Then remove the driver binary from %SystemRoot%\System32\drivers\xhunter2.sys