Loading vulnerability…
Safetica ProcessMonitorDriver.sys IOCTL Privilege Bypass for Protected Process Termination
CVE-2026-0828 is a local privilege bypass vulnerability in the ProcessMonitorDriver.sys kernel driver shipped with Safetica endpoint client x64 versions 10.5.75.0 and 11.11.4.0. The driver exposes an IOCTL path that can be abused by an unprivileged local user to request termination of protected system processes. The flaw stems from insufficient authorization enforcement on a privileged kernel interface, allowing user mode code without adequate privileges to invoke sensitive process-management functionality through the driver. Because the vulnerable component runs in kernel mode, the exposed functionality can be used to act on processes that would normally be protected from termination by standard user-mode access controls.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a local unprivileged attacker to terminate protected system processes. This can cause denial of service against security tooling or other critical services, weaken host defenses, and undermine operating system process protection boundaries. In practical terms, the vulnerability can be used to disable or disrupt endpoint protection, monitoring, or other high-value processes, creating conditions favorable for follow-on malicious activity.
If you can’t patch tonight, do this now.
Until a fixed version is deployed, restrict local unprivileged access to affected systems wherever possible and monitor for abnormal termination of protected or security-relevant processes. Apply application control or driver control policies to limit exposure to vulnerable kernel drivers, and review endpoint hardening measures that reduce the ability of low-privilege users to interact with sensitive device interfaces. Additional compensating controls may include heightened detection for suspicious process termination events involving security products or critical services.
Patch, then assume compromise.
Upgrade Safetica endpoint client x64 from affected versions 10.5.75.0 and 11.11.4.0 to a vendor-fixed release when available. If a fixed release has already been issued by the vendor, deploy it across all affected endpoints and verify the vulnerable driver has been replaced. Standard remediation should include confirming that the driver no longer exposes the unsafe IOCTL behavior to unprivileged callers.
9 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.