HardBreacher PoC Claims Kaspersky Endpoint Security Privilege Escalation on Windows 11

Key Takeaways

• A new proof-of-concept (PoC) called HardBreacher claims a local privilege escalation vulnerability in Kaspersky Endpoint Security on Windows 11.
• The alleged flaw, currently unconfirmed by Kaspersky and without an assigned CVE, targets interactions with a Kaspersky user interface process.
• Successful exploitation could allow a low-privileged local user to create files in protected system directories and potentially disrupt the endpoint security product.
• The PoC is described as unstable and may require multiple attempts and reboots, suggesting limitations on its broad exploitability.
• Defenders should monitor vendor advisories and internal telemetry, but avoid testing the PoC on production systems due to potential instability.

A new proof-of-concept (PoC) named HardBreacher has surfaced, alleging a local privilege escalation vulnerability within Kaspersky Endpoint Security when running on fully updated Windows 11 systems. The claim, however, remains unverified by Kaspersky and has not yet been assigned a Common Vulnerabilities and Exposures (CVE) identifier.

The project, released by a researcher known as MSNightmare, describes the purported flaw as a zero-day elevation-of-privilege issue impacting Kaspersky’s enterprise-grade endpoint protection software.

HardBreacher PoC Details

According to the project’s README file, the HardBreacher PoC was tested on Windows 11 version 25H2, specifically targeting Kaspersky Endpoint Security version 14.0.0.504. The exploit reportedly focuses on manipulating the interaction between a local user and a Kaspersky user interface process.

MSNightmare asserts that successful exploitation facilitates the creation of a DLL file at the path C:WindowsSystem32MY_SNAKE_IS_SOLID.dll, subsequently granting the current user full permissions over this newly created file. Given that the System32 directory is typically safeguarded by stringent permissions, such an outcome, if consistently reproducible, would suggest a low-privileged local user could bypass standard Windows security boundaries.

The repository acknowledges that the proof of concept is not always stable, may encounter errors, and often necessitates multiple attempts to achieve success. MSNightmare also indicated that a system reboot was part of the testing process. These limitations are crucial, as a public PoC, while valuable for investigation, does not automatically confirm widespread exploitability across all configurations, deployments, or product builds.

Potential Impact and Enterprise Concerns

Despite the current instability, the potential impact described is significant. The README claims that gaining control over the targeted Kaspersky UI process could disrupt the security product’s normal operation. The reporter MSNightmare says this could lead to incorrect allow/block decisions for files and potentially leave the endpoint in an unstable state.

A reliable version of such an exploit would be particularly concerning in enterprise environments. Endpoint security solutions typically operate with elevated privileges and possess deep access to critical system components, including files, processes, and policy enforcement mechanisms. Privilege escalation vulnerabilities in security products are highly sought after by attackers because they can effectively transform defensive tools into vectors for attack.

An attacker who has already achieved code execution as a standard Windows user often seeks elevated privileges to disable security protections, modify configurations, access sensitive data, establish persistence, or move laterally within a network. However, the true severity of HardBreacher hinges on whether the reported behavior can be consistently reproduced and if exploitation requires additional local permissions, specific product settings, or user interaction.

What You Should Do

• Organizations deploying Kaspersky Endpoint Security should consider this public claim a potential security alert rather than a confirmed vulnerability.
• Security teams must actively monitor Kaspersky’s official advisories, support channels, and security bulletins for any validation, patches, mitigations, or official statements regarding this issue.
• Review your endpoint telemetry for any unusual activity involving Kaspersky processes, unexpected modifications within the System32 directory, anomalous DLL file creation, or failures of security services.
• Until official vendor confirmation and guidance are available, defenders should refrain from testing the public PoC code on production endpoints. The author of the repository warns that the proof of concept can destabilize the operating system, introducing both operational and security risks during investigation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.