CVE-2026-81963
7.8 · High
Local privilege escalation in the Windows Update Stack through link following
How our CVE-2020-0728 variant hunt led from a false CBS lead to a reproducible TrustedInstaller write and SYSTEM elevation.
The rootzero lab
root from zero
rootzero is an offensive security lab based in Carpentras, France. We publish vulnerability analyses, develop security tools and software, and carry out security assessments.
- Field
- Research and offensive security
- Based in
- Carpentras, France
- Region
- European Union
- Output
- CVEs, write-ups, tools and software
rootzero is the cybersecurity research and engineering lab of Thucy SARL. Company information
Public research
Published vulnerabilities
Each advisory describes the flaw, exploitation requirements and affected versions. It links to the vendor advisory and available patch.
CVE-2026-40864
5.4 · Medium
XSRF bypass in JupyterHub through Sec-Fetch-Mode: no-cors requests
JupyterHub 4.1.0 to 5.4.4 skipped its XSRF check for any no-cors request, so a page on another origin could submit Hub forms for a logged-in user.
pfSense-SA-26_03.webgui
5.2 · Medium
PfSense-SA-26_03: stored XSS in the ARP table through a DHCP-supplied hostname
A DHCP client on the local network could store a hostname carrying JavaScript that ran in a pfSense administrator’s browser when they opened the ARP table.
01The name
root, uid 0.
The name rootzero refers to the root account on Unix systems, whose user identifier is 0.
The symbol represents that zero, opened by a 45° cut.
02What we do
Research, tools and software
-
Research
Public technical write-ups
Vulnerabilities, lab protocols and method notes: hypotheses, evidence, limits, sources and fixes.
Read the technical blog -
Tools
The toolbox, free to use
The utilities from our engagements, built on proven libraries and running in your browser.
Open the tools -
Products
Our security software
SpectrAI tests web applications and APIs. DataShield inventories exposed services. MailSentinel analyses suspicious emails and BreachScan monitors data leaks.
See the products
Autonomous offensive agents: scope guardrails
03Principles
How we work.
-
Start from the facts
Every engagement looks at the scope, the actual exposure and what has been demonstrated. An inventory or a previous report is a starting point, and it does not replace verification.
-
Publish evidence
A finding ships with the observed request, response and impact. An unverified hypothesis is presented as one.
-
Verify every finding
An automated test publishes a finding only after verifying the request and the response that demonstrate it.
-
Share what we learn
Our working tools are free, our research notes are public and our sources are cited.
04Careers
Applications and collaborations
To apply or propose a technical collaboration, email us with a description of your work. You can include a code repository, an article or a vulnerability advisory.
Write to usWork with rootzero
Request a service
Describe the systems involved and your deadline. We will reply to define the scope of work and prepare a proposal.