CVE-2026-14723: AD_Miner 1.9.0 Local Code Execution via Cache Handler Deserialization

Technical summary

CVE-2026-14723 affects the Cache Handler component in AD_Miner 1.9.0, specifically the request_a function within ad_miner/scripts/analyse_cache.py. The vulnerability arises from unsafe deserialization of sys.argv[1], allowing an authenticated local attacker to craft malicious input that triggers arbitrary code execution. The flaw is classified under CWE-502 (Deserialization of Untrusted Data) and CWE-20 (Improper Input Validation). The attack vector is local only; remote exploitation is not feasible. A pull request to remediate this issue has been submitted but is pending acceptance by the project maintainers.

Business impact

Organizations relying on AD_Miner for Active Directory security analysis face a moderate risk. An attacker with valid user credentials on a system running AD_Miner could exploit this to gain elevated privileges or execute malicious code in the security analysis workflow. This could compromise the integrity of security assessments, lead to unauthorized system access, or facilitate lateral movement within an environment. The threat is most acute in multi-user environments or shared analysis systems where unprivileged users have access to the tool.

Affected systems

AD-Security AD_Miner version 1.9.0 is confirmed vulnerable. Organizations should verify their deployed versions against vendor advisories to determine exposure. Versions prior to and after 1.9.0 may also be affected; consult AD-Security's release notes and security updates for comprehensive patch coverage.

Exploitability

Exploitation requires local system access and valid user credentials (low privilege level), making opportunistic remote exploitation infeasible. However, the attack is straightforward to execute once access is obtained—no complex interaction or special conditions are needed. The lack of user interaction requirements (UI:N in the CVSS vector) means the attack can be automated. This moderates the overall exploitability in isolated or air-gapped environments but elevates risk in shared multi-tenant systems or where user account proliferation is high.

Remediation

Patch AD_Miner to a version that includes the fix for CVE-2026-14723. A pull request addressing this issue is pending acceptance; monitor AD-Security's repository and release channels for an official patch. Until a patched version is available, restrict local system access to trusted administrators only and limit unprivileged user access to systems running AD_Miner 1.9.0.

Patch guidance

Consult AD-Security's official repository and security advisories for patch release timelines. Once a patched version is released, test it in a non-production environment to ensure compatibility with your Active Directory infrastructure and existing automation. Apply the update during a maintenance window to all systems running version 1.9.0. If you are a downstream consumer of AD_Miner (e.g., integrating it into a larger toolset), verify that your deployment mechanism pulls from a secure source and check for dependency version pinning that may prevent automatic updates.

Detection guidance

Monitor system logs for unexpected child processes spawned by AD_Miner, unusual Python interpreter invocations, or unexpected modifications to cache files in the AD_Miner working directory. Inspect command-line audit logs for ad_miner/scripts/analyse_cache.py invocations with suspicious sys.argv[1] values—particularly those containing serialized Python objects or encoded payloads. Implementation of file integrity monitoring (FIM) on the cache directory and execution of AD_Miner from a restricted shell can also help detect or prevent exploitation attempts.

Why prioritize this

Although the CVSS score of 5.3 (MEDIUM) reflects the local-only attack vector, the vulnerability should not be ignored. Deserialization flaws are historically high-impact when exploited in production environments. The pending patch status means no immediate mitigation is yet official. Organizations with multi-user systems, shared analysis infrastructure, or where AD_Miner is used in sensitive security workflows should prioritize patching. Environments with strict user access controls and isolated AD_Miner deployments can defer patching until a stable release is available, but should track the pull request status closely.

Risk score, explained

CVSS 3.1 assigns a base score of 5.3 (MEDIUM) due to: local attack vector (AV:L, eliminating remote exploitation), low privilege requirement (PR:L, but still requiring valid credentials), no user interaction needed (UI:N, enabling automation), confidentiality/integrity/availability impact (C:L/I:L/A:L). The score reflects moderate risk in typical deployments. However, context matters—in security tool environments where integrity is critical, or in multi-tenant systems where user segregation is weak, the operational risk may exceed the base score.

Frequently asked questions