CVE-2026-0828
Kernel driver vulnerability in Safetica Endpoint Client
- Published
- Jun 26, 2026
- Updated
- Jun 26, 2026
- Assigning CNA
- certcc
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NLow · next 30 days
- Percentile
- 33.7%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unprivileged user to abuse IOCTL path and terminate protected system processes.
Sources
- cve-2026-0828Exploit
Proof-of-concept exploit for CVE-2026-0828, a BYOVD vulnerability in Safetica ProcessMonitorDriver.sys allowing unprivileged termination of PPL-protected processes and local privilege escalation to SYSTEM via IOCTL abuse and token duplication.
The PoC for CVE-2025-70795 / CVE-2026-0828 and updated driver
- dastExploit
Exploit for CVE-2026-0828 targeting Safetica ProcessMonitorDriver.sys to terminate processes and spawn a SYSTEM shell.
- 0xKern3lCrushResearch
Advanced PoC & Research for CVE-2026-0828 (Safetica) and CVE-2025-7771 (ThrottleStop). Analysis of BYOVD (Bring Your Own Vulnerable Driver) TTPs for Ring 0 process termination and physical memory R/W. Researching EDR-Killer patterns, PPL bypasses, and kernel-mode primitives used by MedusaLocker and other threat actors.
- Terminator_KillerExploit
Kernel-mode process killer exploiting CVE-2026-0828 (BYOVD) to terminate protected processes via a vulnerable signed driver, bypassing PPL and endpoint security.
- BYOVD-ResearchResearch
BYOVD research performed by KOSEC. Includes vulnerable drivers and writeups (CVE-2026-0828).
- KillChainExploit
Kernel Process Termination Tool ( CVE-2026-0828 exploit)
- WinDefenderKillerExploit
Windows Defender Killer | Registry-Based Disablement + BYOVD Process Termination (C++)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.