Researcher Drops 'HardBreacher' Exploit for Kaspersky Security Software
A bug-hunter who has repeatedly embarrassed Microsoft now has Kaspersky in the crosshairs, releasing a proof-of-concept exploit that can hand an attacker near-total control of a Windows machine running Kaspersky Endpoint Security.
Key points
- A researcher using the name Nightmare Eclipse released a working exploit, called HardBreacher, targeting Kaspersky Endpoint Security on or around the weekend of the disclosure.
- The flaw is a privilege-escalation vulnerability, meaning software that runs with low permissions can abuse it to gain near-unlimited control over the operating system.
- Kaspersky says the underlying bug is already fixed and the patch reaches users automatically through the product's regular database update.
- Nightmare Eclipse has previously released exploits for Windows and Microsoft Defender, some of which were later used by criminals in real attacks.
- Users running Kaspersky Endpoint Security should verify their product has received its latest automatic update.
A security researcher who goes by Nightmare Eclipse (also known online as Chaotic Eclipse) released a public exploit over the weekend targeting Kaspersky Endpoint Security. Named HardBreacher, it targets a privilege-escalation vulnerability: every program runs at a certain trust level, and this flaw is a hidden staircase letting an attacker ride from the ground floor to the penthouse.
What can HardBreacher actually do?
Taking control of Kaspersky's own interface process causes the security product to "completely lose it," in the researcher's words. An attacker who succeeds can force Kaspersky to stop working, trick it into granting or blocking access to files it should never touch, and leave "the entire operating system" in a broken state.
"The PoC is not in the best shape at all, it is basically duct tapped, I just managed to make it work and that's all," Nightmare Eclipse wrote in the release. A PoC, or proof-of-concept, is a working demonstration that a flaw is real. It's meant to force a fix, not to hand criminals a ready-made weapon, though criminals have repurposed this researcher's earlier work before. Our coverage of ShieldBreaker, published 12 August, showed exactly how that cycle plays out with Microsoft Defender.
Should Kaspersky users be worried right now?
Probably not, if their software is current. Kaspersky told SecurityWeek the underlying issue is resolved and the fix goes out automatically through the product's routine database update. Users can also trigger that update manually from inside the application.
No CVE identifier or CVSS severity score has been published at the time of writing. A fix is already in the wild, but the formal vulnerability record hasn't appeared in the public database yet.
| Exploit name | Target product | Status |
|---|---|---|
| HardBreacher | Kaspersky Endpoint Security | Patched via automatic update |
| ShieldBreak | Windows (system shell access) | Previously released |
| LegacyHive | Windows (privilege escalation) | Previously released |
Why does this researcher keep releasing exploits publicly?
Nightmare Eclipse started dropping public exploits after growing frustrated with Microsoft's handling of vulnerability reports, the process where researchers privately tell companies about flaws and give them time to fix them before going public. When that breaks down, researchers sometimes release findings openly to force action. Several earlier releases from Nightmare Eclipse were picked up by criminals and used in actual attacks before patches were applied.
This is the sixth time Threat Vectr has covered Nightmare Eclipse since we first reported on the researcher's activity on 9 June 2026. The pattern here is consistent: rough-edged PoCs, real underlying bugs, and a vendor scrambling to confirm a fix is already out. Watch whether a CVE appears in the next few days; its absence right now suggests Kaspersky may have patched quietly before the release rather than after it.
For anyone running Kaspersky Endpoint Security, open the application and confirm it has downloaded its latest update. Automatic updates are on by default, but a manual check takes thirty seconds.
