EUVD-2026-39793
GHSA-4p38-3jmx-75vr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Local IOCTL abuse from an existing low-privilege session sets AV:L/PR:L/AC:L; impact is termination of protected processes, so A:H with C:N/I:N, no scope change.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unprivileged user to abuse IOCTL path and terminate protected system processes.
AnalysisAI
Local privilege/availability abuse in Safetica Endpoint Client (x64) versions 10.5.75.0 and 11.11.4.0 lets an unprivileged user send crafted IOCTLs to the bundled kernel driver ProcessMonitorDriver.sys to terminate protected system processes, including the DLP agent's own self-protection components. This effectively allows a low-privileged local user to disable endpoint security enforcement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to already have a local, interactive (low-privilege) session on a Windows x64 host running Safetica Endpoint Client 10.5.75.0 or 11.11.4.0 with the ProcessMonitorDriver.sys driver loaded - the exploit is the act of opening that driver's device object and sending the specific process-termination IOCTL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided signals are internally contradictory and should be treated with caution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already has a standard, non-administrative account on a managed workstation opens a handle to the ProcessMonitorDriver device and issues the crafted IOCTL to kill the Safetica agent and its self-protection processes, leaving the host's DLP and monitoring blind. They then exfiltrate data or run further tooling that the endpoint agent would normally have blocked. … |
| Remediation | No vendor-released patch version is identified in the available data - neither the EUVD nor the CERT/CC reference includes a fixed build, so monitor CERT/CC VU#818729 (https://www.kb.cert.org/vuls/id/818729) and the Safetica vendor channel (https://www.safetica.com/) for an updated Endpoint Client release beyond 10.5.75.0 / 11.11.4.0 and upgrade once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running Safetica Endpoint Client versions 10.5.75.0 and 11.11.4.0 and assess exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today