CVE-2026-51990

Think of Sogou Input Method like software that provides typing/IM features. In older versions, a part called biz_helper.exe can be tricked over the network into running the attacker’s code, which is like handing a stranger the key to your computer—no special access needed.

This matters if your Windows PCs have Sogou Input Method installed at a version lower than 16.3.0.3498, and the biz_helper.exe component is present. It has been reported as actively exploited in the wild by a China-aligned group (UNC3569), meaning real attackers are using it against victims.

Reachability gate: the risk applies when the vulnerable version is installed and the biz_helper.exe component exists; exploitation is described as network-delivered via a crafted sgbiz URL.

This is RED because exploitation is confirmed in the wild: UNC3569 is actively using this flaw to run code and install a backdoor (GRAYRABBIT). With remote code execution and no authentication requirement, attackers don’t need to be “already inside” your network to get results on an unpatched machine.

1. Confirm exposure on your endpoints

   • Inventory: Identify any machines running Sogou Input Method.
   • Version check: Determine whether the installed version is lower than 16.3.0.3498.
   • Component presence: Confirm whether biz_helper.exe is present as part of the installation.

2. Upgrade/remediate

   • Fixed version: Upgrade Sogou Input Method to 16.3.0.3498 (the version explicitly stated as fixed) or later.
   • If you cannot upgrade quickly: uninstall Sogou Input Method from endpoints that don’t require it, or disable/remove the component if your organization’s policy allows.

3. Validate post-change

   • Re-check version after the update.
   • Ensure the biz_helper.exe component no longer exists on machines where you removed Sogou Input Method.

4. Temporary risk reduction (if patching is delayed)

   • Limit exposure to suspicious network-delivered links (the reported attack flow uses a crafted sgbiz URL).
   • Treat endpoints with internet access and broad user activity as highest priority until updated.

5. What to monitor (during and after remediation)

   • Look for signs of backdoor deployment behavior consistent with GRAYRABBIT activity reports (only if your environment has relevant detections).
   • Monitor for unusual process launches originating from or related to Sogou Input Method and its helper process.

6. KEV note

   • This CVE is not listed in the CISA KEV feed in the provided findings; however, exploitation has still been reported as active in the wild, so prioritize remediation based on that.

Severity: Critical (network-based remote code execution). Weakness type: CWE-94 (code injection / improper handling that enables execution of attacker-controlled code). Attack mechanism: a remote attacker can trigger the biz_helper.exe component in Sogou Input Method to execute arbitrary commands without authentication; user interaction is described as not required in the findings, and exploitation has been reported via a crafted sgbiz URL that leads to a one-click RCE chain (including argument injection, unrestricted URL navigation, and additional outdated component behavior). Exploitation status: confirmed exploited in the wild, with reporting attributing activity to UNC3569 and describing deployment of the GRAYRABBIT backdoor. KEV: not listed in CISA KEV per the findings provided. Patch availability: the findings state the issue is fixed in 16.3.0.3498; no additional patch availability details were provided beyond that.