The Security Product Became the Privilege-Escalation Primitive

The research matters because endpoint security software operates with extensive privileges. A weakness in that trusted control can give an attacker a route through protections that were installed to stop them.

What the proof of concept targets

The HardBreacher repository targets Kaspersky Endpoint Security version 14.0.0.504 on a fully patched Windows 11 25H2 system, according to its author. The technique manipulates product behaviour to place an attacker-controlled DLL under System32 with privileges the current user does not normally have.

If the chain succeeds, control of a privileged Kaspersky interface process can support further abuse. The researcher says that could include stopping the security product or influencing file access, and believes the technique could be developed into a more reliable one-click exploit.

Those are research claims about capability. The published code is described as unreliable and may require repeated attempts. It is not evidence of a stable criminal tool or an observed campaign.

Why an unreliable proof of concept still matters

Public exploit code changes the defender’s timeline. It gives other researchers and attackers a starting point, reveals the vulnerable trust relationship and reduces the effort required to test affected environments.

Reliability can improve quickly after publication. A chain that works only under narrow conditions today may become easier to use after someone removes race conditions, adds version checks or packages the technique into another tool.

Kaspersky says the issue is resolved

Kaspersky told SecurityWeek that it resolved the underlying issue. The company said customers receive the fix automatically through database updates or can trigger a manual database update.

That delivery model is important. An organisation may have installed the same product version shown in the proof of concept but still be protected if current databases contain the fix. Conversely, an endpoint with stale update status may remain exposed even when its application version looks unchanged.

What defenders should verify

• Confirm Kaspersky Endpoint Security database updates completed successfully on every managed endpoint.
• Investigate devices that have missed updates, been offline or cannot contact the update infrastructure.
• Look for unexpected DLL creation under System32 and unusual activity involving Kaspersky interface processes.
• Review attempts by standard users to manipulate security-product files, services or quarantine workflows.
• Use application control and endpoint telemetry to identify new privileged module loads.
• Do not disable the security product as a general workaround unless Kaspersky explicitly directs it.
• Track the HardBreacher repository and vendor guidance for reliability changes or additional affected versions.

No CVE and no confirmed exploitation

The public reports did not identify a CVE at the time of writing. There is also no confirmed malicious exploitation. Those limitations should stay visible in risk communication.

They do not make the research irrelevant. A public privilege-escalation primitive affecting a widely trusted endpoint control is worth validating before a more polished exploit appears.

The BlackTree view

Endpoint security products are trusted to inspect, quarantine and modify files with privileges ordinary applications do not have. HardBreacher shows how that trust can become the attack surface.

The right response is measured verification: confirm the automatic fix, identify systems that missed it and hunt for the specific privileged file activity the technique requires. Defenders should neither dismiss an unreliable proof of concept nor describe it as an active campaign without evidence.

Sources

• MSNightmare: HardBreacher proof-of-concept repository, publicly available by 31 August 2026. Repository timestamps should be consulted for individual commits.
• SecurityWeek: Nightmare Eclipse drops HardBreacher Kaspersky product exploit, published 31 August 2026 at 10:32 ET.