Security News Comodo Exploited : ComoDoS - Exploiting a Remote Kernel Vulnerability in Comodo Internet Security

[Khushal]

Content source

https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html

https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html

Note: at the time of publishing this, the vulnerability is still a zero-day.

I’ve submitted a full report, root-cause analysis, along with patch suggestions, and a proof-of-concept to Comodo’s security team. In spite of this, I’ve gotten no response. I followed up twice, my most recently email simply asking for a confirmation that they received my report, but only radio silence.

 

[Bot]

That is a serious report, but the safest approach is to avoid treating it as confirmed beyond what the researcher published.

What can be said with confidence

• The quoted post claims a remote kernel vulnerability in Comodo Internet Security and says the vendor had not responded at the time of publication.
• If the write-up and proof-of-concept are legitimate, this would be a high-impact issue because kernel-level vulnerabilities can have severe consequences.
• A public claim alone is not the same as independent verification, vendor confirmation, or an assigned CVE.

Why caution is important

• Technical blog posts can be accurate, but forum members still should not assume full validity until there is broader confirmation.
• “Zero-day” in this context usually means no patch is available at disclosure, but exact real-world exploitability can still depend on configuration, version, and attack conditions.
• Without vendor acknowledgement, affected build details and mitigation guidance may be incomplete.

Reasonable next steps for users

• Check Comodo’s official advisories, release notes, and support channels for any statement or update.
• If you use the product in a sensitive environment, consider reducing exposure until there is clarification, especially where remote attack surface is relevant.
• Keep the product and Windows fully updated in case a silent fix or related hardening update appears.
• Monitor trusted community analysis and independent testing rather than relying only on the original post.

About the vendor non-response

A lack of reply is not a good look, but it still does not prove the report was ignored internally. Sometimes reports are received without timely acknowledgement, though that is not ideal for coordinated disclosure.

Bottom line

This should be treated as a credible security claim that deserves attention, but not as fully confirmed fact until there is independent verification or an official vendor response. The practical takeaway is to watch for advisories and updates rather than speculate beyond the published evidence.

 

[SeriousHoax]

This is the guy who found the way loophole to stop the Wannacry ransomware. So, not a random POC creator.

 

[Brownie2019]

A remotely exploitable zero-day vulnerability in Comodo Internet Security’s kernel-level firewall driver allows attackers to crash Windows systems with a single IPv6 packet, and the vendor has yet to respond.

Security researcher Marcus Hutchins publicly disclosed a critical zero-day vulnerability in Comodo Internet Security on June 3, 2026, after multiple attempts to reach the vendor failed.

Dubbed ComoDoS, the flaw resides in Inspect.sys, Comodo’s firewall kernel driver, and enables a remote Denial-of-Service (DoS) attack capable of triggering a Blue Screen of Death (BSOD) on targeted Windows machines.

How the Vulnerability Works

Read more on:

Comodo Internet Security 0-Day Flaw Triggers Windows System Crashes

A remotely exploitable zero-day vulnerability in Comodo Internet Security's kernel-level firewall driver allows attackers to crash Windows systems.

gbhackers.com

 

[stonjean633]

Comodo already got so much love from users here.

They don't need such negativity especially this case as remotely exploitable/kernel fw driver.

 

[Zero Knowledge]

Here we go again I thought we were over this The only voice I want to hear from on Comodo is cruelsister and her tests otherwise .

 

[Andy Ful]

Such attacks (RDoS) should not worry home users. However, they are common against enterprises.
This exploit and a few others (still unpatched) make CIS questionable as a protection in businesses.
A better solution for businesses would be Xcitium or another good EDR.

 

[LinuxFan58]

Well for opinion based information I agee with @Zero Knowledge, but as @SeriousHoax posts this is a white hat security expert with a strong reputation, but as @Andy Ful posts a Denial of Service attack let's your PC crash, not a big deal for home users, but a serious issue for businesses depending on IT/internet and let's be honest CIS is not designed for the B2C market but for the consumer market, making the real world impact of this find minimal, although the lack of offical Comodo response is worrying in relation to brand reputation. But Comodo has both strong advocates and fierce criticizers, so the brand reputation damage is minimal. Hardcore Comodo fans will keep on using CIS. Hardcore criticizers will see this as evidence for their opinion.

 

[Andy Ful]

Yes, from the vendor's website, we can see that CIS is intended for home users. Anyway, CIS is used sometimes in small businesses too.
We should not demand business-level support; however, many users can feel disappointed.

 

[cruelsister]

Here we go again I thought we were over this The only voice I want to hear from on Comodo is cruelsister and her tests otherwise .

Although an interesting write-up, it's more of a Fun Fact than any sort of critical vulnerability. Actually the author states that the python exploit, although crashing the system, will not result in any sort of Remote Code Execution- "I totally accept defeat, but at least the journey was fun".

In the absence of a RCE (which would be a severe problem) we are left with the possibility of causing a crash- just find a Comodo protected system, get it's IP, then run the script remotely and hope the Router doesn't get in the way. Seems like a bunch of work to me, but whatever...

 

[rashmi]

Router bags Oscar for the guest appearance — Comodo wins a show again — Melih will need a trophy shelf upgrade!

 

[LinuxFan58]

Well most modern (mid and high end) router have Ipv6 statefull packet inspection it would drop the malformed Ipv6 and prevent causing Comodo to go down (as CruelSister hints on), but older and cheaper routers often don´t have that functionality. So people with older or low end routers better not enable Ipv6 because the NAT firewall is for Ipv4 not IPv6 and will let IPv6 packet straight through.