CVE-2026-3609

High

Description

Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0.10011.16384 through 2023.12.7.78, privilege escalation vulnerability provides access to the IRP_MJ_WRITE command interface, which allows any user process to request a PROCESS_ALL_ACCESS. Note: KVE 2023-5589 (https://krcert.or.kr) was initially issued for version 10.0.10011.16384, but the vulnerability was not fully remediated and remains in version 2023.12.7.78.

SeverityHigh

CVSS7.8

Exploit probability—

ProductWellbia Xigncode3

PublishedMay 11, 2026

First seenMay 11, 2026

Weakness typeCWE-269Improper privilege management CWE-732CWE-732 CWE-284Improper access control CWE-266CWE-266

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

Product	Affected versions	Fixed in
wellbia xigncode3	10.0.10011.16384	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.