Loading story…
Researcher Chaotic Eclipse, using the GitHub handle MSNightmare, released PrettyPrague, a public proof of concept claiming a local privilege-escalation zero-day in GenDigital Avast Antivirus. The PoC allegedly abuses the Avast Sandbox component on fully patched Avast installations running fully updated Windows 11 25H2 to dump the Windows Security Account Manager (SAM) database and start a shell as NT AUTHORITY\SYSTEM.
No CVE, vendor advisory, root-cause analysis, coordinated-disclosure details, or confirmed patch was available, leaving the claim unverified. The researcher speculated that AVG and Norton products could also be affected but provided no supporting evidence; organizations using Avast should monitor vendor guidance and investigate anomalous Avast Sandbox activity, SAM access, and unexpected SYSTEM-level process creation.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
The public PrettyPrague repository attributed to MSNightmare/Chaotic Eclipse was last updated and claimed an unpatched Avast Antivirus Sandbox privilege-escalation flaw. The PoC purportedly dumps the Windows SAM database and opens an NT AUTHORITY\SYSTEM shell on fully patched Avast Antivirus and Windows 11 25H2 systems; no CVE, vendor confirmation, or patch information was provided.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said it is preparing a security update for **RoguePlanet**, a publicly disclosed Microsoft Defender zero-day tracked as `CVE-2026-50656`. The flaw affects fully patched **Windows 10** and **Windows 11** systems and allows local privilege escalation to **SYSTEM** by exploiting a race condition in the **Microsoft Malware Protection Engine**. Researcher **Nightmare Eclipse** released a public proof-of-concept exploit, and reports said the issue can be triggered whether Defender real-time protection is enabled or disabled, with possible impact in passive mode as well. The researcher said the bug may originally have supported remote code execution before Microsoft hardening changes in May blocked some attack paths, after which the exploit was reworked to bypass mitigations. Microsoft acknowledged the vulnerability and said it is investigating while developing a patch. The disclosure comes amid an ongoing dispute between Nightmare Eclipse and Microsoft over bug bounty and coordinated disclosure practices, and follows several other Windows flaws the researcher has publicly exposed, including **BlueHammer**, **RedSun**, **UnDefend**, **GreenPlasma**, and **YellowKey**.
Jul 13, 2026
A proof-of-concept exploit for a new Microsoft Defender local privilege escalation flaw dubbed **RedSun** was published by researcher **Chaotic Eclipse**, with reports saying it works on fully patched **Windows 10**, **Windows 11**, and **Windows Server 2019 and later** when Defender is enabled. The zero-day allows an unprivileged local user to gain **SYSTEM** privileges by abusing Defender’s handling of files tagged by cloud detection, and Microsoft had not released a patch at the time of reporting. Independent researcher **Will Dormann** reportedly validated the exploit chain, which uses the **Windows Cloud Files API**, opportunistic locks, and **NTFS junctions/reparse points** to redirect Defender into overwriting a protected binary under `C:\Windows\System32` and then executing it as SYSTEM. The disclosure followed an earlier Defender privilege-escalation exploit, **BlueHammer**, which Microsoft patched as `CVE-2026-33825`, while defenders were urged to watch for anomalous Defender file writes, `cldapi.dll` activity, and oplock-assisted redirection behavior pending a vendor fix.
Jun 29, 2026
A high-severity local privilege escalation flaw tracked as **`CVE-2025-71326`** affects **AVAST Antivirus 25.11** on Windows, allowing a non-privileged local user to potentially execute arbitrary code with **SYSTEM** privileges. The vulnerability stems from an **unquoted service path** in the Avast SecureLine service, `SecureLine`, where the binary path points to `C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe`, creating an opportunity for path hijacking during service execution. The issue was previously documented in a verified **Exploit-DB** entry authored by Milad Karimi (**Ex3ptionaL**) and has now been assigned a CVE and high severity ratings, including **CVSS 4.0 8.5** and **CVSS 3.1 7.8**. Although the flaw is not remotely exploitable and requires local access, successful exploitation could significantly affect confidentiality, integrity, and availability. Recommended mitigation includes quoting the service path, removing unnecessary spaces where possible, and applying vendor fixes or updates when available.
Jun 29, 2026