On 2026-08-31, GitHub user MSNightmare released HardBreacher, a proof-of-concept local elevation-of-privilege (EoP) exploit targeting Kaspersky Endpoint Security v14.0.0.504 on a fully patched Windows 11 25H2 host. The PoC does not require network access, social engineering, or an existing administrative foothold -- only a standard local user account on an endpoint running the affected Kaspersky build. GBHackers' reporting characterizes the flaw as enabling 'unprivileged users to gain SYSTEM-level privileges through local access,' though the author's own repository notes the code does not yet reliably achieve arbitrary SYSTEM-level code execution.

The exploit works by taking control of Kaspersky's UI process (avp.exe), which runs with kernel-adjacent, security-product-level file-system permissions to perform real-time inspection. According to the author, 'the Kaspersky completely loses it when you take control over the UI process,' after which the tool can influence the product's internal file-operation decisions and write a marker file, MY_SNAKE_IS_SOLID.dll, into C:\Windows\System32 with full permissions granted to the invoking standard user -- a path normally protected by NTFS DACLs and Windows path virtualization. Placing the payload directly inside the legitimate System32 tree, rather than a user-writable location, blends the artifact with genuine OS/vendor files. The payload component is built as a Windows DLL (Visual C++ project 'SolidSnake': dllmain.cpp, framework.h, pch.h/.cpp) that includes ntdll.h, indicating use of undocumented/internal NT API calls rather than only public Win32 calls, consistent with a process-injection-based takeover of the target process; the GitHub repository README itself contains no explicit listing of individual Win32 API calls used.

The author explicitly describes the tool as a 'duct taped' proof-of-concept ('I just managed to make it work'): execution is unreliable, 'often ends in error, requiring retries,' and can leave the endpoint in a degraded state -- Kaspersky 'can stop functioning' or unpredictably 'grant/block access to files it's not supposed to.' GBHackers' coverage also frames a broader potential impact chain -- disabling security defenses, accessing protected data, and using credentials/tokens exposed to higher-privileged contexts for persistence or lateral movement -- but this framing is presented as potential downstream risk rather than something the PoC itself demonstrates; no persistence or lateral-movement behavior is documented in the exploit code or README. No coordinated disclosure to Kaspersky is documented in the repository.

HardBreacher was released the same day as two companion zero-day PoCs by the same researcher: PrettyPrague (a sandbox-escape EoP against fully patched Avast/Gen Digital Antivirus that dumps the SAM database and spawns a full SYSTEM shell) and GreenSection (an out-of-bounds write in a global NVIDIA user-mode shared-memory section, triggerable by any Vulkan- or OpenGL-using application, that can cross user boundaries or compromise the dwm.exe process). This researcher -- publicly known as MSNightmare / NightmareEclipse / INFINITE NIGHTMARE / Chaotic Eclipse -- has a documented Spring-2026 history of publishing unconfirmed, largely uncoordinated PoCs against Windows security tooling and OS components: BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, ShieldBreak, RoguePlanet (referencing the already-patched, NVD-published CVE-2026-50656, a Microsoft Malware Protection Engine EoP), LegacyHive (Windows ProfSvc), and GreatXML (a BitLocker bypass); some of these prior PoCs reportedly achieved SYSTEM privileges or disk-protection bypass. A single Spanish-language outlet (securitylab.lat) additionally reports that Microsoft closed the researcher's coordinated-disclosure account over an alleged breach of reporting terms, a claim Microsoft is reported to dispute as uncoordinated disclosure on the researcher's part; this dispute is uncorroborated elsewhere and treated here as unverified context for the researcher's current shift toward non-Microsoft targets (Kaspersky, Avast, NVIDIA).

As of this writing, no CVE has been assigned to the Kaspersky flaw and no bulletin referencing HardBreacher or Kaspersky Endpoint Security v14.0.0.504 appears on Kaspersky's own advisory feed (threats.kaspersky.com). One Russian-language outlet (anti-malware.ru), and separately securitylab.lat, reported -- citing unnamed/unofficial sourcing -- that Kaspersky had already shipped an automatic fix ('обновление с необходимыми исправлениями выпущено и устанавливается автоматически'); this claim is uncorroborated by Kaspersky's own advisory channel or by any independently verifiable technical bulletin and is treated here as unverified.