Detections · CVE-2026-20841: Arbitrary Code Execution in the Windows Notepad

Public CTI triage - CVE-2026-20841

sigma · Pending service validation

title: Public CTI triage - CVE-2026-20841
id: 6a8077d7-7b7e-5b54-8c6f-ec6058e303e2
status: experimental
description: Triage observable telemetry associated with the public report keyword.
references:
  - https://www.thezdi.com/blog/2026/2/19/cve-2026-20841-arbitrary-code-execution-in-the-windows-notepad
logsource:
  category: process_creation
detection:
  selection:
    process.command_line: 'CVE-2026-20841'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity
level: medium

SPL triage - CVE-2026-20841

spl · validation unavailable

index=* (CommandLine="*CVE-2026-20841*")

KQL triage - CVE-2026-20841

kql · validation unavailable

DeviceProcessEvents | where ProcessCommandLine contains "CVE-2026-20841"