Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2026-0828 EUVD-2026-39793GHSA-4p38-3jmx-75vr

Kernel driver vulnerability in Safetica Endpoint Client

Published Jun 26, 2026 · Updated Jun 26, 2026 · Assigned by certcc

Vendor: Safetica Product: Endpoint Client

Description

Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unprivileged user to abuse IOCTL path and terminate protected system processes.

Affected products

VendorProductAffectedFixed
Safetica Endpoint Client 10.5.75.0 – ≤ 10.5.75.0, 11.11.4.0 – ≤ 11.11.4.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 6 repositories

  • DeathShotXD/0xKern3lCrush ★ 61 · Feb 4, 2026

    Advanced PoC & Research for CVE-2026-0828 (Safetica) and CVE-2025-7771 (ThrottleStop). Analysis of BYOVD (Bring Your Own Vulnerable Driver) TTPs for Ring 0 process termination and physical memory R/W…

  • ANYLNK/STProcessMonitorBYOVD ★ 49 · Feb 14, 2026

    The PoC for CVE-2025-70795 / CVE-2026-0828 and updated driver

  • oxfemale/KillChain ★ 38 · Apr 2, 2026

    Kernel Process Termination Tool ( CVE-2026-0828 exploit)

  • KOSEC-LLC/BYOVD-Research ★ 14 · Oct 15, 2025

    BYOVD research performed by KOSEC. Includes vulnerable drivers and writeups (CVE-2026-0828).

  • ximerag/dast ★ 1 · Sep 2, 2026

    CVE-2026-0828

  • mein-0/cve-2026-0828 ★ 1 · May 27, 2026

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References