Penetration Tester: 2026-09-22

1. Windows Exploitation Techniques: Dangling COM Object Registrations

   Google Project Zero, 2026-09-21. Read, 9 min.

   James Forshaw of Google Project Zero describes CVE-2026-66804, a Windows privilege-escalation bug Microsoft recently fixed, as an incomplete fix for CVE-2026-50343, the flaw Calif dubbed Dark Elevator. The CrossDevice COM class stayed registered system-wide against a DLL path under C:\ProgramData that did not exist, so any user could plant a DLL there, and the post includes a PowerShell script that finds other COM classes whose registered DLL is missing.

   Why it matters for this role: You break in on purpose, and a dangling system-wide COM registration pointing at a writable, missing DLL path is a reusable local privilege-escalation primitive on Windows, complete with a script to find more.

2. ZTE SmartHome Account Takeover: Password Reset Without Verification Code

   Mina Nageh (minanagehsalalma.github.io), 2026-09-20. Read, 17 min.

   A researcher published an account of four vulnerabilities that ZTE PSIRT verified in the ZTE SmartLife Android app and its account backend, the strongest a password-reset flaw ZTE rated CVSS 8.8 whose validated flow accepted a target account and a new password with no old password or verified reset code. ZTE published four advisories on September 20, 2026 and assigned CVE-2026-86552 through CVE-2026-86555, and it treated a separate account-deletion behavior as test-environment-only, outside the confirmed CVE set.

   Why it matters for this role: This is a clean chain to study for your engagements: recover trust material shipped in a mobile client, forge the app-auth context, then abuse a reset flow ZTE confirmed took a new password with no old password or reset code.

Penetration Tester