CVE-2026-0828: Safetica ProcessMonitorDriver IOCTL Privilege Escalation & Process Termination

Technical summary

CVE-2026-0828 is a privilege escalation and denial-of-service vulnerability in ProcessMonitorDriver.sys, a kernel-mode driver bundled with Safetica endpoint client versions 10.5.75.0 and 11.11.4.0 on 64-bit Windows systems. The driver fails to properly validate or authorize IOCTL requests, permitting unprivileged users to invoke protected process termination functionality. This breaks the process isolation guarantees that the driver is intended to enforce, allowing arbitrary process kills without administrator rights.

Business impact

An attacker exploiting this vulnerability could disable endpoint protection, terminate antivirus monitors, kill logging agents, or halt critical business applications. The ability to terminate protected processes without authentication creates both immediate availability risk and potential compliance violations if security monitoring is disrupted during an incident. Organizations relying on Safetica for endpoint protection face degraded security posture if users or malware on their systems leverage this flaw to cripple defenses.

Affected systems

Safetica endpoint client x64 versions 10.5.75.0 and 11.11.4.0 are affected. Organizations should verify their installed Safetica version against these specific release numbers. The vulnerability is kernel-level and affects Windows systems using the vulnerable versions; 32-bit versions and other Safetica product lines have not been reported as affected based on available information.

Exploitability

The vulnerability can be exploited by any unprivileged user on an affected system without requiring special tools or interaction. IOCTL exploitation is straightforward from user-mode applications, making this practically exploitable. No authentication, elevated privilege, or user interaction is needed, though the attacker must have local code execution ability. The low barrier to exploitation combined with direct access to critical system functionality elevates the practical risk.

Remediation

Update Safetica endpoint client to a patched version beyond 11.11.4.0 or verify against the vendor advisory for the specific fixed release. Organizations should prioritize this update across all endpoints running the vulnerable versions. If immediate patching is not possible, restrict driver loading or disable Safetica's process protection features as a temporary mitigation, though this reduces security posture. Consult Safetica's official security advisory for definitive patch guidance and timelines.

Patch guidance

Contact Safetica support or check their security advisory portal for the latest patched versions. Version 11.11.4.0 is confirmed vulnerable; organizations should upgrade to the next stable release confirmed by Safetica as containing the IOCTL validation fix. Test patches in a non-production environment before enterprise deployment. Safetica typically bundles updates with their management console; coordinate with your Safetica administrator or vendor account team for staged rollout if managing many endpoints.

Detection guidance

Monitor for unexpected IOCTL calls to ProcessMonitorDriver.sys from user-mode processes, particularly those not typically associated with Safetica management. Endpoint Detection and Response (EDR) tools should flag repeated IOCTL 0x**** sequences targeting process termination. Log kernel driver load events and monitor for unusual process termination patterns, especially of system services or security software. A sudden cluster of protected process kills from non-administrative contexts is a strong indicator of exploitation.

Why prioritize this

This vulnerability combines high ease of exploitation (unprivileged user, no authentication) with direct impact to process integrity and endpoint security. The ability to terminate protected processes without privilege escalation is a critical failure of a security driver's core function. While not yet listed on CISA's KEV catalog, the straightforward exploitation path and security control bypass warrant immediate prioritization, particularly in environments where endpoint protection is a primary security control.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects high network and local attack complexity, no privilege requirement, and high impact to system integrity through process termination. However, the score assumes high confidentiality impact which may not align with denial-of-service exploitation; the practical impact is significant availability damage through process kills and potential information disclosure if protected security tools are silenced during an attack.

Frequently asked questions