GREENmod pipe ACL flaw enables SSRF
CVE-2026-5131 in GREENmod allows unprivileged attackers to exploit misconfigured named pipe ACLs for SSRF attacks against Windows systems via SMB or WebDav; patched in v2.8.33.
CERT Polska disclosed CVE-2026-5131, a vulnerability in GREENmod software stemming from incorrectly configured access control lists on named pipes used for inter-component communication. The flaw allows local attackers to interact with these pipes and upload arbitrary XML or JSON files that are processed with the privileges of the service account. This design weakness enables Server-Side Request Forgery (SSRF) attacks against any Windows system running the GREENmod agent that supports SMB or WebDav communication.
The vulnerability was responsibly disclosed by security researcher Marcin Ressel and has been addressed by the vendor in GREENmod version 2.8.33. Organizations running affected versions should prioritize upgrading to the patched release. The issue represents a privilege escalation and lateral movement risk in environments where GREENmod is deployed, as attackers with local access can leverage the service's elevated privileges to perform unauthorized network operations.
Mentioned in this report
Detection guidance
Non-Service Process Connecting to GREENmod IPC Named Pipe
Detects a process other than the expected GREENmod service binary opening or connecting to a GREENmod named pipe, consistent with exploitation of CVE-2026-5131 (misconfigured pipe ACLs) to submit malicious XML/JSON payloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Non-Service Process Connecting to GREENmod IPC Named Pipe
id: b2c18d66-69a0-5bfa-8a28-287796d44321
status: experimental
description: Detects a process other than the legitimate GREENmod service binary connecting
to a GREENmod-related named pipe, which may indicate exploitation of CVE-2026-5131
(weak pipe ACLs) to inject XML/JSON content processed with service privileges.
logsource:
category: pipe_created
product: windows
detection:
selection:
PipeName|contains: greenmod
filter:
Image|contains:
- \GreenMod\
- \Program Files\GreenMod
condition: selection and not filter
falsepositives:
- Legitimate GREENmod agent processes installed in non-default directories
- Third-party monitoring or backup agents that legitimately hook into GREENmod IPC
channels
level: high
tags:
- attack.t1068
- attack.privilege_escalation
author: Vorant
GREENmod Agent Initiating Outbound SMB or WebDAV Connection (Possible SSRF)
Detects the GREENmod agent process making outbound SMB or WebDAV connections, consistent with SSRF abuse of CVE-2026-5131 where attacker-supplied pipe input causes the service to issue unauthorized network requests. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: GREENmod Agent Initiating Outbound SMB or WebDAV Connection
id: 0135c7d1-7e73-5f1b-8540-92ab37266389
status: experimental
description: Detects the GREENmod agent process establishing outbound connections
to SMB (445/139) or WebDAV (80/443 via WebClient) endpoints, which may indicate
SSRF exploitation of CVE-2026-5131 where a locally injected named-pipe payload causes
the service to reach attacker-controlled or unintended internal/external hosts.
logsource:
category: network_connection
product: windows
detection:
selection:
Image|contains: greenmod
Initiated: 'true'
DestinationPort:
- 445
- 139
- 80
- 443
condition: selection
falsepositives:
- Normal GREENmod agent traffic to its configured management or update servers over
SMB/HTTP
- Legitimate file share or WebDAV integrations configured as part of GREENmod functionality
level: medium
tags:
- attack.t1071.002
- attack.command_and_control
author: Vorant
Suspicious Child Process Spawned by GREENmod Service
Detects command interpreters or scripting engines spawned by the GREENmod service process, indicating potential post-exploitation after abusing the named-pipe ACL flaw to execute code with service-account privileges. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by GREENmod Service
id: d15ca6ed-d5d6-5c4b-9f22-12371f58282d
status: experimental
description: Detects command shells or scripting interpreters launched as children
of the GREENmod service process, which may indicate successful privilege escalation
via CVE-2026-5131 after abusing a misconfigured named pipe to run arbitrary code
with elevated service privileges.
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: greenmod
Image|endswith:
- \cmd.exe
- \powershell.exe
- \wscript.exe
- \cscript.exe
- \rundll32.exe
- \mshta.exe
condition: selection
falsepositives:
- Legitimate administrative scripts intentionally invoked by GREENmod maintenance
tasks
- Scheduled update or diagnostic routines that call scripting engines from the service
context
level: high
tags:
- attack.t1068
- attack.privilege_escalation
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-5131
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free