Kaspersky Endpoint Security Got a Public Privilege-Escalation PoC
- The Mess: A researcher known as Nightmare Eclipse has published HardBreacher, a public proof of concept targeting Kaspersky Endpoint Security for Windows. The PoC claims a low-privileged user can abuse the security product’s UI process to write a DLL into the protected
System32directory. - The Damage: If the reported privilege boundary can be reliably crossed, an attacker who already has local code execution could potentially turn that foothold into elevated access and interfere with endpoint protection.
- The Fix: Make sure Kaspersky Endpoint Security is fully updated, monitor for unexpected changes inside
System32, and treat the public PoC as a serious local-security signal even though the full impact has not been independently established.
Your antivirus is supposed to stop the attacker.
What happens when the antivirus becomes the privilege-escalation target?
That’s the question raised by HardBreacher, a newly published public PoC targeting Kaspersky Endpoint Security for Windows.
The researcher behind it claims the vulnerability can be triggered from a low-privileged account and can cross a Windows security boundary.
The PoC is already public.
The Protected Directory Is the Red Flag
The reported behavior is simple enough to understand.
HardBreacher targets Kaspersky Endpoint Security 14.0.0.504 on Windows 11 25H2.
According to the researcher’s documentation, a successful run can create a DLL inside:
C:\Windows\System32
and give the current user permissions on that file.
That’s not normal behavior for an unprivileged Windows account.
System32 exists specifically because Windows doesn’t want ordinary users casually modifying trusted system components.
The Security Product Is Part of the Attack Path
The researcher claims the problem involves taking control of a Kaspersky UI process.
That is important because endpoint-security software operates with significantly greater privileges than the user sitting in front of the machine.
Security products need deep access.
They monitor files.
They inspect processes.
They enforce policies.
They interact with privileged Windows components.
Those same privileges make them attractive targets.
From Local Access to Something Worse
A privilege-escalation vulnerability normally starts with an attacker who already has some level of access.
That doesn’t make it harmless.
Modern attacks are chains.
For example:
phishing → malicious document → user-level code execution → privilege escalation → SYSTEM
The first vulnerability gets the attacker onto the machine.
The second removes the restrictions.
HardBreacher is interesting because it potentially occupies that second position.
The PoC Is Not a Perfect Exploit
There is an important caveat.
The researcher himself describes the PoC as unstable.
It may fail and require repeated execution attempts.
That means we shouldn’t pretend this is already a reliable one-click SYSTEM exploit.
Independent researchers reviewing the code have also pointed out that the public material does not yet establish a complete, reproducible chain to arbitrary SYSTEM-level execution across affected environments.
That’s a significant distinction.
A public PoC can demonstrate a broken security boundary without proving that every installation is remotely or locally exploitable in the same way.
But the Signal Is Still Bad
Unstable doesn’t mean irrelevant.
If an unprivileged user can manipulate a protected location through a security product’s privileged process, attackers have something worth investigating.
They can improve reliability.
They can remove unnecessary steps.
They can adapt the technique to other product versions.
That’s how rough research sometimes becomes a production exploit.
Kaspersky Says the Issue Is Fixed
Kaspersky was contacted about the vulnerability and stated that the underlying issue has been resolved.
The company says the corresponding fix is delivered through an automatic update, with users also able to trigger a database update manually.
That means the immediate defensive action isn’t complicated:
update Kaspersky.
Don’t wait for a CVE number before doing it.
Watch System32
Organizations using Kaspersky Endpoint Security should also monitor for unusual changes to protected system directories.
Particularly interesting events include:
- unexpected DLL creation
- unusual file permissions
- suspicious Kaspersky process behavior
- security-product crashes
- unexpected changes to protected files
- endpoint protection suddenly becoming unreliable
A privilege-escalation attempt may fail.
The failure can still leave useful telemetry behind.
Don’t Test This on Production
The public PoC is reportedly unstable and can interfere with the operating system and security product.
That makes production testing a particularly bad idea.
If security researchers need to validate the behavior, use an isolated laboratory system matching the reported Windows and Kaspersky versions.
The goal is to establish whether the behavior is reproducible — not to break someone’s workstation.
Why Security Software Bugs Are Different
A vulnerability in a calculator application is annoying.
A vulnerability in endpoint security software is different.
Security products sit at a privileged position by design.
They can:
- inspect protected files
- access processes
- enforce security policies
- communicate with kernel components
- react to suspicious activity
If an attacker can manipulate those capabilities, the defensive layer can become part of the attack chain.
That’s why EDR and antivirus vulnerabilities deserve attention even when they require local access.
The Bigger Lesson
HardBreacher also shows why public PoCs need to be read carefully.
There are three very different statements:
“A researcher published code.”
“The code demonstrates a security boundary violation.”
“Attackers can reliably obtain SYSTEM on every affected installation.”
Those are not the same thing.
Right now, the first two have meaningful evidence.
The third still needs stronger validation.
That doesn’t justify ignoring the issue.
It just means we report what is actually known.
Bugstoday Opinion
Security software gets a strange privilege in our heads.
We install it.
We trust it.
Then we stop thinking about it as software.
That’s a mistake.
Antivirus products contain parsers, services, drivers, IPC mechanisms and privileged processes.
They’re software.
And software has bugs.
HardBreacher is interesting precisely because it attacks the thing sitting between the user and the rest of the operating system.
Bugstoday verdict: don’t wait for a CVE number to take a public privilege-escalation PoC seriously. Update the endpoint, monitor the protected paths, and remember that your security product is part of the attack surface too.
Today’s Bugs. Tomorrow’s Breaches.
Sources
- Kaspersky — official security/threat information
- MSNightmare/HardBreacher — public research repository
- GitHub — HardBreacher repository
- Windows — System32 security boundary documentation
