What is the CVSS score of CVE-2026-0828?

CVE-2026-0828 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Safetica Endpoint Client are affected by CVE-2026-0828?

Safetica Endpoint Client versions 10.5.75.0 and 11.11.4.0 contain a flaw allowing any local user to completely disable the organization's DLP protections without administrative credentials, creating…

Is there a public PoC exploit available for CVE-2026-0828?

Yes, a public proof-of-concept exploit is available for CVE-2026-0828. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-0828?

Within 24 hours: Inventory all systems running Safetica Endpoint Client versions 10.5.75.0 and 11.11.4.0 and assess exposure scope. Within 7 days: Since no vendor patch is currently available, implement compensating controls (see below) and restrict local system access to trusted accounts only. Within 30 days: Contact Safetica for patch status and timeline; evaluate alternative DLP solutions if remediation cannot be applied within acceptable risk window.

Safetica Endpoint Client CVE-2026-0828

EUVD-2026-39793 HIGH

2026-06-26 certcc

GHSA-4p38-3jmx-75vr

Information Disclosure Endpoint Client

7.5

CVSS 3.1 · Vendor: certcc

Severity by source

Vendor (certcc) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local IOCTL abuse from an existing low-privilege session sets AV:L/PR:L/AC:L; impact is termination of protected processes, so A:H with C:N/I:N, no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 18:23 vuln.today

CVSS changed

Jun 26, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jun 26, 2026 - 15:47 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unprivileged user to abuse IOCTL path and terminate protected system processes.

AnalysisAI

Local privilege/availability abuse in Safetica Endpoint Client (x64) versions 10.5.75.0 and 11.11.4.0 lets an unprivileged user send crafted IOCTLs to the bundled kernel driver ProcessMonitorDriver.sys to terminate protected system processes, including the DLP agent's own self-protection components. This effectively allows a low-privileged local user to disable endpoint security enforcement. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; CERT/CC (VU#818729) coordinated the disclosure.

Technical ContextAI

The flaw resides in ProcessMonitorDriver.sys, a Windows kernel-mode driver shipped with Safetica's data-loss-prevention endpoint agent to monitor and protect processes. The driver exposes an IOCTL (I/O control) interface via a device object that user-mode code can open with DeviceIoControl. The root cause is missing or insufficient authorization/caller validation on a process-termination IOCTL path: the driver acts on the request with kernel privileges without verifying that the caller is privileged enough to target protected processes. No CWE was assigned in the input, but the behavior maps to the CWE-862 (Missing Authorization) / CWE-782 (Exposed IOCTL with Insufficient Access Control) class. The two CPE entries both reference cpe:2.3:a:safetica:endpoint_client, confirming the affected product is the application-level endpoint client rather than a separate driver package SKU.

RemediationAI

No vendor-released patch version is identified in the available data - neither the EUVD nor the CERT/CC reference includes a fixed build, so monitor CERT/CC VU#818729 (https://www.kb.cert.org/vuls/id/818729) and the Safetica vendor channel (https://www.safetica.com/) for an updated Endpoint Client release beyond 10.5.75.0 / 11.11.4.0 and upgrade once published. As compensating controls while unpatched, restrict interactive and local logon rights on endpoints running the agent so untrusted users cannot open the driver's device interface, and use application allow-listing/EDR to detect unexpected DeviceIoControl calls against the ProcessMonitorDriver device and unexpected termination of the Safetica agent processes (trade-off: detection-only, does not block the IOCTL). Where supported, enabling tamper-protection alerting on the DLP agent helps surface process-kill attempts, though it will not prevent a kernel-level termination. Avoid removing the driver, as that disables the DLP protection entirely.