RoguePlanet CVE-2026-50656: wermgr.exe Accessed via VSS Shadow Copy Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

Detects instances where the Windows Error Reporter (wermgr.exe) process attempts to open a handle to a Volume Shadow Copy (VSS) device. This behavior is anomalous as legitimate VSS operations are typically performed by dedicated system processes (e.g., vssvc.exe, diskshadow.exe), and such access by wermgr.exe may indicate an attempt to bypass file locks for credential dumping or sensitive data exfiltration.