CVE-2026-43619 — Arbitrary File Access

title: Rsync Symlink Race Condition - Arbitrary File Access via Path Manipulation - CVE-2026-43619
id: scw-2026-05-20-ai-1
status: experimental
level: high
description: |
  Detects the use of rsync.exe with specific command-line arguments that are indicative of attempting to exploit the symlink race condition vulnerability (CVE-2026-43619). Attackers can use these arguments to manipulate file permissions, ownership, or timestamps on arbitrary files outside the intended rsync module when 'use chroot = no' is configured.
author: SCW Feed Engine (AI-generated)
date: 2026-05-20
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-43619/
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
    category: process_creation
detection:
  selection:
      Image|endswith:
          - 'rsync.exe'
      CommandLine|contains:
          - '--chmod='
          - '--chown='
          - '--utimes='
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse