List of real-world threats against endpoint protection software - For future reference. The list is based on public information and thus is obviously incomplete.

The list should include:

• Non-public 0-day exploits at the time of reference
• Public incidents where attackers exploited endpoint protection software
• Supporting public evidence should be provided for all records

The list doesn't include:

• Exploits intentionally disclosed to the vendor in any way (including full uncoordinated disclosure)
• Detection bypasses, because I don't want to fill up the storage space of GitHub
• Attacks or exploits against perimeter products, because I'm lazy

• As of November 2016. Zerodium (a prominent vulnerability broker) is offering up to $40.000 for Antivirus LPE/RCE
• In 2014. Kaspersky reported that the Careto malware was attempting to exploit a vulnerability in their products "to make the malware 'invisible' in the system". The targeted vulnerability was fixed in 2008.
• In 2015. Kaspersky reported a compromise of their own systems. According to the report "neither [Kaspersky's] products nor services have been compromised", and attackers were after information about "ongoing investigations [...] detection methods and analysis capabilities".