ON 31 August 2026 a researcher using the handle Nightmare Eclipse published an exploit dubbed HardBreacher that targets a privilege‑escalation flaw in Kaspersky Endpoint Security. The code, posted to a public GitHub repository, lets an unprivileged user gain control of the product’s user‑interface process and effectively disable the security agent. The disclosure prompted an outage‑style alert as organisations noticed their endpoints no longer enforcing protection. Security teams began investigating after seeing alerts about missing real‑time scanning and unusual process terminations on affected workstations.
The code, posted to a public GitHub repository, lets an unprivileged user gain control of the product’s user‑interface process and effectively disable the security agent. The exploit leverages a weakness in how Kaspersky’s interface process interacts with the Windows operating system. By abusing this interaction HardBreacher can create arbitrary files in the System32 directory, a step that normally requires administrator rights. Testing has been carried out against Kaspersky version 14.0.0.504, although the researcher notes the exploit remains unstable and does not succeed reliably on every attempt. The underlying issue appears to stem from insufficient validation of user‑supplied parameters passed to the UI process before it performs file operations.
No CVE identifier has been assigned to the vulnerability and Kaspersky has stated that the issue is resolved by the automatic update channel. The fix modifies the way the UI process validates incoming requests, preventing the file‑creation abuse. Until the update is applied the flaw could be used to bypass Windows privilege boundaries and install persistent artifacts. Kaspersky advised customers to verify that the latest build is active and to reboot endpoints if the update does not apply automatically.
Nightmare Eclipse has previously released similar tools such as ShieldBreak and LegacyHive, which focused on Windows and Microsoft Defender weaknesses. To date no threat‑actor group has been observed using HardBreacher in the wild, and independent researchers have not yet reproduced the exploit reliably. The lack of third‑party confirmation means the finding remains provisional and warrants further scrutiny. Nevertheless the release serves as a reminder that security products themselves can become an attack surface when their privileged components are not hardened.
Defenders should first confirm that Kaspersky Endpoint Security is configured to receive automatic updates and that the installed build is later than the vulnerable version. Monitoring Windows event logs for unexpected writes to System32 or for changes to the Kaspersky UI service can help detect attempted abuse. Application‑control rules that block non‑system processes from creating files in System32 add an extra layer of protection. Additionally, restricting interactive logon rights for standard users reduces the chance that an unprivileged account can trigger the flawed interface.
Running a vulnerability scan against endpoint assets will highlight any machines still running the outdated build. Security teams may also wish to test the exploit in an isolated laboratory to verify that the patch blocks the file‑creation behaviour. Maintaining the principle of least privilege for user accounts and keeping Windows itself patched reduces the overall risk even if a future variant of the flaw appears. Organisations should also consider sharing any observed indicators with their information‑sharing partners to help build a broader defensive picture.