CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Avast Antivirus

product · product:avast-antivirus

Coverage
1
first 2026-09-06 → last 2026-09-10
Latest activity
2026-09-10
CrowdStrike, Gen Digital and Kaspersky have all now remediated one researcher's four security-product PrivEsc…
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector, technology · regions: europe
Sources cited
3
3 hosts

Action items (1)

Do-now tasks recorded on the entries about Avast Antivirus, newest first. Check the date before acting on an older one.

  • Confirm every CrowdStrike Falcon sensor and Gen Digital Avast install (including on unmanaged or contractor endpoints) is on the current release now that both vendors are reported to have remediated FalconFlank and PrettyPrague; until that is confirmed, treat any endpoint on an older build as still exposed and keep the "Microsoft Office File Suspicious Macro Removal Windows" Falcon prevention setting disabled as an interim control on unconfirmed hosts.
    2026-09-06CrowdStrike, Gen Digital and Kaspersky have all now…

Defender insights

What each entry about Avast Antivirus tells a defender to do, newest first.

2026-09-06HIGHCrowdStrike, Gen Digital and Kaspersky have all now remediated one researcher's four security-product PrivEsc PoCs, per LevelBlue's follow-up analysis

Latest update · triage

Story timeline

  1. 2026-09-06Chaotic Eclipse turns its zero-day drops on third-party security products: local privilege escalation in CrowdStrike Falcon and Avast, with working proof-of-concept code public; all three vendors have since remediated
    trending-vulnerabilitiesCrowdStrike, Gen Digital and Kaspersky have all now remediated one researcher's four security-product PrivEsc PoCs, per LevelBlue's follow-up analysis

Hunting pivots

Releases covered
Avast Antivirus
Tags
lpepatch-availablepoc-publicpriv-escvulnerabilities
ATT&CK techniques (6 across 4 tactics)

6 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ExecutionHijack Execution Flow: DLL
  • Privilege EscalationExploitation for Privilege Escalation · Access Token Manipulation: Parent PID Spoofing · Abuse Elevation Control Mechanism: Bypass User Account Control
  • StealthAccess Token Manipulation: Parent PID Spoofing · Exploitation for Stealth · Hijack Execution Flow: DLL
  • Credential AccessOS Credential Dumping: Security Account Manager

Execution TA0002

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-09-06/chaotic-eclipse-falconflank-prettyprague-edr-av-lpe-drops · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-09-06/chaotic-eclipse-falconflank-prettyprague-edr-av-lpe-drops · ATT&CK page ↗

T1134.004Access Token Manipulation: Parent PID Spoofing×1

Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the <code>CreateProcess</code> API call, which supports a parameter that defines the PPID to use. This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via <code>svchost.exe</code> or <code>consent.exe</code>) rather than the current user context.

Evidence: 2026-09-06/chaotic-eclipse-falconflank-prettyprague-edr-av-lpe-drops · ATT&CK page ↗

T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control×1

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.

Evidence: 2026-09-06/chaotic-eclipse-falconflank-prettyprague-edr-av-lpe-drops · ATT&CK page ↗

Stealth TA0005

T1134.004Access Token Manipulation: Parent PID Spoofing×1

Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the <code>CreateProcess</code> API call, which supports a parameter that defines the PPID to use. This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via <code>svchost.exe</code> or <code>consent.exe</code>) rather than the current user context.

Evidence: 2026-09-06/chaotic-eclipse-falconflank-prettyprague-edr-av-lpe-drops · ATT&CK page ↗

T1211Exploitation for Stealth×1

Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.

Evidence: 2026-09-06/chaotic-eclipse-falconflank-prettyprague-edr-av-lpe-drops · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-09-06/chaotic-eclipse-falconflank-prettyprague-edr-av-lpe-drops · ATT&CK page ↗

Credential Access TA0006

T1003.002OS Credential Dumping: Security Account Manager×1

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access.

Evidence: 2026-09-06/chaotic-eclipse-falconflank-prettyprague-edr-av-lpe-drops · ATT&CK page ↗

Entries about Avast Antivirus (1)

2026-09-06 · view entry permalink →

HIGHupdatedNATOB1

Chaotic Eclipse turns its zero-day drops on third-party security products: local privilege escalation in CrowdStrike Falcon and Avast, with working proof-of-concept code public; all three vendors have since remediated

The pseudonymous researcher tracked here as Nightmare Eclipse, and by The Hacker News under the further aliases Chaotic Eclipse, INFINITE NIGHTMARE and MSNightmare, spent 2026 publishing working proof-of-concept exploits for Windows and Microsoft Defender privilege escalations without giving the vendor advance notice. In early September the target set changed: three of the four latest drops are against third-party endpoint security products rather than Microsoft's, and at disclosure two of them had no fix (The Hacker News, 2026-09-03); both are now reported remediated (see the update below). That shift is what makes this an operational matter for estates that never had Defender in scope.

FalconFlank abuses CrowdStrike Falcon Sensor's Office malicious-macro remediation path. The remediation routine runs at high privilege in order to clean an infected document in place, and the exploit turns that cleanup into a low-privileged account's route to SYSTEM. Truesec, reading the release independently, records the preconditions precisely: the proof-of-concept "works in a fully updated windows 11 25H2 / Windows Server 2025 with Crowdstrike Falcon – Phase 3 Optimal Protection with 'Microsoft Office file malicious macro removal' setting" (Truesec, 2026-09-04). A CrowdStrike spokesperson told The Hacker News the company is "actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting", adding that customers "remain protected through the Cloud Anti-malware for Microsoft Office Files settings" (The Hacker News, 2026-09-03). At disclosure there was no patch and no CVE, and the only control on offer was turning a prevention feature off, which Truesec notes means malicious macros will no longer be replaced in place while cloud-side blocking continues (Truesec, 2026-09-04); CrowdStrike is now reported to have remediated the flaw (see the update below).

PrettyPrague is the same shape against a different vendor. The researcher describes it as dumping the SAM database "by abusing a vulnerability in Avast Sandbox" and spawning a full SYSTEM shell against fully patched Avast Antivirus on a patched Windows 11 25H2 host, and states a belief that other Gen Digital products including AVG and Norton are affected (The Hacker News, 2026-09-03). Gen Digital confirmed a vulnerability "affecting a subset of Gen products, including Avast Antivirus, that could allow an attacker to elevate their system privileges" and said at the time it was "actively developing a patch", without naming which further products are in scope (The Hacker News, 2026-09-03); Gen Digital is now reported to have shipped that fix (see the update below). The third drop, HardBreacher against Kaspersky Endpoint Security for Windows 14.0.0.504, is the one that is resolved: Kaspersky told the same outlet the fix ships through an automatic database update or a manually triggered one (The Hacker News, 2026-09-03). A fourth release, GreenSection, is described only as an NVIDIA memory-corruption bug that crashes any application using Vulkan or OpenGL, rather than a privilege escalation (The Hacker News, 2026-09-03).

The releases are unco-ordinated by the researcher's own account, and the reason they give matters for timeline planning rather than attribution. The Hacker News reports the researcher claiming that Microsoft continues to ignore them and refuses to engage in "any sort of communication", and quotes them saying they "can't even report the bugs I find to their respective vendors because of the restrictions by Microsoft" (The Hacker News, 2026-09-03). The same reporting quotes them planning the timing of future drops: "Think I will start publishing bugs for third-parties in that window where Patch Tuesday isn't released yet" (The Hacker News, 2026-09-03). For a defender that means there is no embargo to wait out and no co-ordinated patch date, the gap between publication and a vendor fix is open-ended, and by the researcher's own stated intent the next drop is likelier to land in the days before a Patch Tuesday than after one.

Triage: these exploits ride a security agent's legitimate high-privilege routines, so the signal is not the agent acting with privilege, which it always does. What separates abuse is what the privileged action produces: a remediation or sandbox operation followed by a process spawning from an unexpected parent under a low-privileged user's session, a write into a system directory that the agent's normal cleanup does not target, or SAM access originating from the antivirus process tree rather than from a backup or credential-management workflow. Because the code is public and the researcher notes detections may already exist, an endpoint alert naming the agent's own remediation component is worth treating as an exploitation attempt rather than a product fault.

We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting

The Hacker News (quoting a CrowdStrike spokesperson)

As of now the PoC works in a fully updated windows 11 25H2 / Windows Server 2025 with Crowdstrike Falcon – Phase 3 Optimal Protection with “Microsoft Office file malicious macro removal” setting.

Truesec 2026-09-04

Gen was recently made aware of a security vulnerability affecting a subset of Gen products, including Avast Antivirus, that could allow an attacker to elevate their system privileges. We immediately initiated our security response procedures and are actively developing a patch.

The Hacker News (quoting a Gen Digital spokesperson)

Every Windows logon session has a private object directory inside the kernel's namespace – \\Sessions\\0\\DosDevices\\{AuthId}\\, and any standard user process can place symbolic links inside their own session's directory without any special privilege.

The vulnerability is that a standard user process can send IOCTL 0x82AC0054 directly to the aswSnx driver to request that a chosen executable be run inside the sandbox.

For CrowdStrike clients to be susceptible to this local privilege escalation vulnerability, an endpoint must be assigned to a Prevention Policy with the "Microsoft Office file malicious macro removal" setting enabled. This vulnerability does not impact CrowdStrike Falcon Government clients.

LevelBlue (Trustwave) SpiderLabs 2026-09-09

As of September 4, 2026, Gen has released a patch for the following versions of Avast Antivirus for Windows

The Hacker News 2026-09-03
Updaterun 2026-09-10T0410Z-inteltitleheadlinesummarytagsactionsentitiestechniquessourcesevidencesourcing_noteclassificationbody

LevelBlue SpiderLabs independently reproduced and analysed all four PoCs, adding mechanism-level detail none of the original vendor statements carried. HardBreacher: "every Windows logon session has a private object directory inside the kernel's namespace – \Sessions\0\DosDevices\{AuthId}\, and any standard user process can place symbolic links inside their own session's directory without any special privilege" (LevelBlue SpiderLabs, 2026-09-09); the exploit builds a fake filesystem tree redirecting Kaspersky's avpuimain.dll load path to an attacker DLL, then spawns avpui.exe suspended with the redirect live and resumes it so the OS loader loads the malicious DLL, additionally using NtCreateUserProcess with the parent-process attribute set to explorer.exe so EDR process-tree telemetry records Explorer, not the real caller, as the parent, the payload then hides and terminates the product's user-facing notification process from inside. PrettyPrague: "the vulnerability is that a standard user process can send IOCTL 0x82AC0054 directly to the aswSnx driver to request that a chosen executable be run inside the sandbox" (LevelBlue SpiderLabs, 2026-09-09), where the sandbox's virtualized SAM-hive copy carries none of the real SAM's ACLs; the exploit races the sandbox's own cleanup to copy the hive out via a rolled-back Kernel Transaction Manager transaction, decrypts NTLM hashes offline using the LSA boot key, and reaches a SYSTEM context through a CMSTPLUA COM-interface UAC bypass to log in as every local admin, reverting the passwords afterward. FalconFlank's precondition is narrower than the original report suggested: "for CrowdStrike clients to be susceptible to this local privilege escalation vulnerability, an endpoint must be assigned to a Prevention Policy with the 'Microsoft Office file malicious macro removal' setting enabled. This vulnerability does not impact CrowdStrike Falcon Government clients" (LevelBlue SpiderLabs, 2026-09-09), and in LevelBlue's own lab testing, CrowdStrike's cloud-based ML engine (detection logic OnWriteOfficeMacroMLMedium) identified and quarantined the malicious DLL the exploit stages, preventing the final privilege-escalation step in that test run, a detection outcome that limits, without eliminating, the real-world exploitability the initial disclosure implied. LevelBlue independently characterises GreenSection differently from the original report's "memory-corruption bug that crashes any application using Vulkan or OpenGL": its own analysis describes a standard user opening, mapping, modifying and restoring an NVIDIA global shared-memory section, with no privilege-escalation or code-execution primitive demonstrated, a narrower, trust-boundary-design finding rather than a crash bug, though LevelBlue did not claim to have tested for a crash condition either.

LevelBlue's closing assessment also updates the patch picture this entry originally carried: "PrettyPrague demonstrated the most significant security impact prior to remediation, while HardBreacher highlighted opportunities for security-product abuse and evasion. GreenSection is primarily a security design concern, and FalconFlank's operational relevance was limited both by its configuration-dependent exposure and by rapid vendor remediation" (LevelBlue SpiderLabs, 2026-09-09); both FalconFlank and PrettyPrague are now reported remediated, which supersedes the "no fix"/"still developing a patch" status this entry carried at disclosure. The Hacker News's own update to its original report names a specific fix: "as of September 4, 2026, Gen has released a patch for the following versions of Avast Antivirus for Windows - 26.7.11086, fix version 992 [and] 26.8.11125, fix version 993" (The Hacker News, 2026-09-03). No source reached for this entry names a specific fixed CrowdStrike Falcon build or date for FalconFlank; confirm current release status directly with CrowdStrike rather than treating this as a version-checkable patch.

vulnerability06 Sep 14:00Zmulti-sourceOpen finding →
Sources: The Hacker News · Truesec · LevelBlue (Trustwave) SpiderLabs

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • levelblue.com1 (33%)
  • thehackernews.com1 (33%)
  • truesec.com1 (33%)
All cited sources (3)