{"id":"EM-20261105-4S5X","url":"https://cyber.eventmonitor.net/incident/EM-20261105-4S5X/sogou-input-method-vulnerability-cve-2026-120422/","type":"cve","title":"Sogou Input Method Vulnerability (CVE-2026-120422)","subtitle":"CVE-2026-120422","subject":"CVE-2026-120422","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T18:26:37.000Z","firstSignal":"2026-11-04T10:17:26.120Z","lastSignal":"2026-11-05T18:26:37.000Z","updated":"2026-11-05T18:40:01.230Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T18:26:37.000Z","why":"second independent source: C160 Reddit r/netsec"},{"status":"Developing","at":"2026-11-05T18:26:37.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-04T10:17:26.120Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-05T18:26:37.000Z","what":"Born: second source, C160 Reddit r/netsec. Page EM-20261105-4S5X created."}],"stages":[{"name":"Disclosed","at":"2026-11-04T10:17:26.120Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-04T10:17:26.120Z","detail":"CVSS 8.9 · EPSS 0.4%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-04T10:17:26.120Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-120422 (CVSS 8.9)","text":"Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious configurations. An attacker can exploit this vulnerability to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components. This can result in arbitrary code execution when the downloaded files are su","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120422"},{"at":"2026-11-05T18:26:37.000Z","source":"C160","sourceName":"Reddit r/netsec","role":"Crowd","severity":1,"title":"Sogou Input Method update hijack installs DarkVigil backdoor; update to 16.10 (CVE-2026-120422)","text":"submitted by /u/glatisantbeast to r/netsec [link] [comments]","url":"https://www.reddit.com/r/netsec/comments/1xoq81f/sogou_input_method_update_hijack_installs/"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-04T10:17:26.120","score":8.9,"severity":"HIGH","desc":"Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server resp","product":"","seen":1793803438877},"kev":null,"epss":{"epss":0.00446,"pct":0.38957,"at":1793904001230},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}