CVE-2026-36425

CVSS 3.1: 6.5 medium
EPSS: <1%p36
Published: Jul 16, 2026 · Jul 16, 2026
Modified: Jul 17, 2026

Analyze CVE-2026-36425 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation.

Weakness: CWE-269

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news

1 story

Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools

Acronis details a Spark RAT campaign against Cambodia abusing the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to disable Microsoft Defender and other security tools.

The Hacker NewsAug 27, 13:22 UTC · Aug 27, 2026MalwareExploitedCVE-2026-364251 · 1 read