Defender for Endpoint and Antivirus
CVE-2026-33825: Microsoft Defender Elevation of Privilege Vulnerability
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Published
ExploitedYes, in CISA KEVAdded 22 Apr 2026
Ransomware useKnownPer CISA
SeverityHIGHCVSS 3.1 7.8
EPSS0.40%Chance of exploitation in 30 days
Public exploitNot tracked
FixAvailable
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Microsoft Defender Antimalware Platform 4.0 | 4.18.26030.3011 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Exploitation
CISA lists this CVE as exploited in the wild since 22 Apr 2026, including in ransomware campaigns.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 11 Oct 2026.