CVE-2026-38763 Overview
CVE-2026-38763 is a denial of service vulnerability in Unistal Systems Pvt. Ltd. Protegent 360 version 2.0.0.4. A local attacker can trigger a denial of service condition by interacting with the sub_13828 function. The flaw affects an anti-virus product that runs with elevated privileges, making service disruption a meaningful risk for endpoint availability. Public technical analysis is available through the DreadSec Vulnerability Report and the associated GitHub Repository D7EAD.
Critical Impact
A local attacker can crash Protegent 360 v2.0.0.4 by invoking sub_13828, disrupting endpoint anti-virus protection.
Affected Products
- Unistal Systems Pvt. Ltd. Protegent 360 v2.0.0.4
- Protegent kernel-mode anti-virus components referenced in the DreadSec advisory
- Endpoints running the affected Protegent installation
Discovery Timeline
- 2026-07-22 - CVE-2026-38763 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-38763
Vulnerability Analysis
The vulnerability resides in the sub_13828 function within Protegent 360 v2.0.0.4. A local attacker with the ability to execute code on the host can invoke this function in a manner that causes the process or driver to terminate abnormally. Because Protegent 360 is an anti-virus product, an induced crash removes real-time protection from the endpoint. The DreadSec advisory documents multiple related issues in the Protegent kernel anti-virus surface, indicating that the affected code paths are reachable from user mode.
Root Cause
The root cause is improper handling of input or state within the sub_13828 routine. The exact defect class is not disclosed in the NVD entry, but the observable outcome is a denial of service condition consistent with an unhandled exception, invalid memory access, or missing validation. No CWE has been assigned to this record.
Attack Vector
Exploitation requires local access to a host running Protegent 360 v2.0.0.4. An attacker running as a standard user issues a crafted call that reaches sub_13828, causing the anti-virus service or driver to fail. Successful exploitation disables endpoint protection until the service or system is restarted, creating a window for follow-on activity. See the DreadSec Vulnerability Report for reverse engineering details.
Detection Methods for CVE-2026-38763
Indicators of Compromise
- Unexpected termination or repeated restarts of Protegent 360 service processes on hosts running version 2.0.0.4.
- Windows Application or System event log entries recording faults in Protegent binaries referencing sub_13828.
- Sudden gaps in anti-virus telemetry or scan activity from otherwise active endpoints.
Detection Strategies
- Correlate service crash events with preceding process creation activity from non-administrative users.
- Alert on installed Protegent 360 build 2.0.0.4 through software inventory queries.
- Monitor for local processes issuing IOCTLs or API calls to Protegent kernel components before a crash.
Monitoring Recommendations
- Forward Protegent service state changes and crash dumps to a central log platform for review.
- Track anti-virus health status across the fleet and flag hosts where protection stops unexpectedly.
- Review endpoint telemetry for local privilege-adjacent tooling running near Protegent fault events.
How to Mitigate CVE-2026-38763
Immediate Actions Required
- Inventory all endpoints running Unistal Protegent 360 v2.0.0.4 and prioritize them for remediation.
- Restrict local logon and code execution on affected hosts to trusted administrative users.
- Configure automatic restart and alerting for the Protegent service so that outages are surfaced quickly.
Patch Information
No vendor advisory or fixed version is referenced in the NVD entry at the time of publication. Consult Unistal Systems directly and monitor the DreadSec Vulnerability Report for updates on a patched release.
Workarounds
- Limit interactive and remote local access to hosts running the affected Protegent version until a fix is available.
- Apply application control policies to block untrusted binaries from executing on protected endpoints.
- Consider running a supplementary endpoint protection product to maintain coverage if Protegent is disrupted.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
