Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Saturday, 13-Jun-2026 06:52:20 JST Will Dormann

   in reply to

   Someone on the Bad Site pointed out that the exploit only triggers upon entry to a Defender Offline scan. To which the author replied:

   Exactly why I kept repeating the victim machine needed to have at least one offline scan initiated before the attack can be done without authentication.

   So at the end of the day, I think GreatXML is a thing you can do do someone's computer that results in the comouter's administrator themselves getting an unexpected privileged command prompt.

   So what? 🤷♂️