Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unprivileged user to abuse IOCTL path and terminate protected system processes.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Public exploits 7
- ANYLNK/STProcessMonitorBYOVD PoC on GitHub
- DeathShotXD/0xKern3lCrush PoC on GitHub
- Hika-sec/Terminator_Killer PoC on GitHub
- KOSEC-LLC/BYOVD-Research PoC on GitHub
- mein-0/cve-2026-0828 PoC on GitHub
- oxfemale/KillChain PoC on GitHub
- ximerag/dast PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Change history 1
- First seenCVSS 7.5NVD modified 2026-10-25 17:10
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.