As reported by SecurityAffairs, security researcher Chaotic Eclipse (aka Nightmare Eclipse) has released HardBreacher, a proof-of-concept exploit targeting a privilege escalation vulnerability in Kaspersky Endpoint Security. The PoC reportedly works against a fully patched Windows 11 25H2 system running Kaspersky Endpoint v14.0.0.504, though the researcher describes it as unstable and requiring repeated execution attempts.
This release fits a familiar pattern. Chaotic Eclipse has previously published zero-day PoCs targeting Microsoft Defender and Windows components — some of which were later observed being exploited in the wild. Whether HardBreacher follows that trajectory depends on two factors: how quickly organizations apply whatever patch Kaspersky has issued, and whether criminal actors find the instability tolerable enough to weaponize. Even an unreliable LPE chain can be highly valuable when chained with a browser or document exploit, where the attacker already has initial execution and simply needs elevation.
Vulnerability Details
| Field | Details |
|---|---|
| Product | Kaspersky Endpoint Security |
| Affected Version | v14.0.0.504 (as tested by researcher) |
| Tested OS | Windows 11 25H2 (fully patched) |
| Vulnerability Type | Local Privilege Escalation (LPE) |
| PoC Name | HardBreacher |
| Patch Status | Kaspersky states the vulnerability has been addressed (no CVE identifier publicly confirmed at time of writing) |
| Active Exploitation | No confirmed in-the-wild exploitation reported; PoC is publicly available |
| Severity Assessment | High — local privilege escalation on endpoint protection agent undermines the security stack itself |
Why This Matters Beyond the CVE
The most concerning aspect of this exploit is its target. Privilege escalation against an endpoint security product is particularly dangerous because the AV agent typically runs at the highest integrity levels and is trusted by the operating system. If an attacker can manipulate the AV's UI process — as the researcher claims — they may be able to interfere with file access controls, disrupt scanning, or destabilize the system in ways that create persistent blind spots.
The researcher claims that taking control of Kaspersky's UI process can cause the antivirus to stop functioning and interfere with file-access controls, potentially leaving the system in an unstable state.
This is the second-order risk that defenders often overlook: a compromised security agent isn't just a failed control — it's a potential tool for the attacker. Tamper protection mechanisms exist for this reason, but they are not infallible.
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions
- Verify your Kaspersky Endpoint Security version across all managed endpoints. If you are running v14.0.0.504 or earlier, treat this as a high-priority patching event.
- Check for Kaspersky's official advisory and apply the latest available build. Kaspersky has stated the issue is addressed — confirm which version contains the fix through your Kaspersky admin console or support portal.
- Enable tamper protection if not already active. Ensure that attempts to modify or disable the AV agent generate alerts.
- Monitor for the PoC artifact: The researcher states a successful exploit creates
C:\Windows\System32\MY_SNAKE_IS_SOLID.dll. While trivial to rename in a weaponized version, this specific path is a useful detection signal for the public PoC. Deploy a file integrity monitoring rule or EDR query for unexpected DLL creation in System32. - Hunt for UI process anomalies: Alert on unexpected processes interacting with or injecting into the Kaspersky UI process. Legitimate administrative tooling should be baseline and allowlisted.
- Review EDR coverage: Ensure your EDR can detect DLL creation in System32 by non-system processes and privilege escalation behavior chains.
Broader Hardening
- Adopt least-privilege endpoint policies — Application control or allowlisting reduces the attack surface for initial execution that precedes LPE exploitation.
- Segment and monitor — If an endpoint agent is compromised, network segmentation and behavioral analytics become your backstop.
- Track Chaotic Eclipse's disclosures proactively. This researcher has a track record of releasing functional PoCs for security products. Treat future disclosures as pre-incident intelligence, not curiosity.
The disclosure debate around Chaotic Eclipse's methodology will continue, but defenders cannot afford to wait for consensus. A public PoC for privilege escalation against a widely deployed endpoint product is an immediate operational risk. Verify your versions, apply patches, and tune your detections today.
