Ghidra 12.1.2 ACE — unexpected child process from JVM (CVE-2026-20128)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects suspicious or unexpected child processes spawned from a Ghidra JVM environment. This rule is designed to monitor for potential Remote Code Execution (RCE) or Arbitrary Code Execution (ACE) attempts targeting Ghidra, where the application environment is abused to launch system shells, interpreters, or common attacker tools.