A security researcher known as Chaotic Eclipse has released a working proof-of-concept exploit for an unpatched privilege escalation vulnerability in Avast Antivirus, the consumer security suite owned by Gen Digital. The exploit, named PrettyPrague, abuses a flaw in the Avast Sandbox to dump the Windows SAM credential database and spawn a shell running as NT AUTHORITY\SYSTEM.
No CVE or CVSS score exists because the flaw was never reported to the vendor. The researcher, also tracked as Nightmare-Eclipse and publishing under the GitHub handle MSNightmare, pushed the code to a public repository on August 30, 2026. It is the campaign's first drop that does not target Microsoft.
What PrettyPrague Does
Avast runs privileged services that a standard user cannot normally touch. PrettyPrague turns that privilege against the product: it reaches the Security Account Manager hive, where Windows stores local password hashes, and returns an interactive SYSTEM shell. That is a full local compromise from an unprivileged account, with the antivirus itself as the escalation path.
Which Avast Versions Are Affected
The researcher states the exploit works against "any version of Avast Antivirus" and reports testing it on a fully patched Avast install on Windows 11 25H2. They believe other Gen Digital products, including AVG and Norton, may share the flaw. Cyber Kendra has not verified that claim, and no affected build list exists.
Has Gen Digital Responded?
Not publicly. Gen Digital's security advisories page carried no entry when checked on August 31, 2026, and the company has not commented. There is no patch, advisory, or vendor-supplied workaround.
How Fast the Exploit Is Spreading
Cyber Kendra queried GitHub's public API on August 31. The repository, created at 16:43 UTC on August 30, had reached 125 stars and 31 forks in roughly 24 hours. The fork count is the number of defenders to watch. GitHub terminated this researcher's account in May 2026 and wiped six earlier exploit repositories, but every fork is an independent copy that survives a takedown. The code is licensed under the MIT license, which places no restrictions on redistribution.
How to Reduce Exposure
Until a fix ships, treat Avast endpoints as escalation candidates. Hunt for non-SYSTEM processes reading the SAM registry hive, and alert on Sysmon Event ID 1 where a command shell appears as a child of an Avast service process. Event ID 4688 showing SYSTEM-integrity process creation in a standard user session is the same signal. Rotate local account credentials on any host where you find those artefacts.
Related: Critical cPanel Root Flaw
Hosting operators have a second problem open this week. cPanel disclosed CVE-2026-65643 on August 27, 2026, a critical flaw in the domain parking and addon-domain functions of cPanel and WHM. Any authenticated account allowed to add a parked or addon domain can write arbitrary files on the server, leading to code execution as root. All supported versions are affected; fixes shipped across the 110, 134, 136, and 138 branches. On shared hosting, one cheap account reaches every other site on the box.