LIVE FEED
Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiperHardening a Personal Linux Server in an AfternoonMicrosoft 365 outage disrupts Outlook, Teams, and Copilot worldwideCheck Point patches zero-day root escalation flaw exploited against customersHackers Compromise 4,800 GitHub Accounts to Steal Cloud CredentialsHow to Put a Self-Hosted Service Behind SSO and Intrusion Blocking in an AfternoonBaker Tilly notifies clients of data breach at third-party provider
HIGH Actively exploited Used in ransomware CWE-1220

CVE-2026-33825

Microsoft Defender Elevation of Privilege Vulnerability

Microsoft·Defender

7.8/ 10
CVSS 3.1
High severity
6.9%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 94% of all CVEs
Listed
CISA KEV catalog
Added
Apr 22, 2026
Fix due
May 6, 2026
Ransomware
Known use
Timeline
Published
Apr 14, 2026
Updated
Oct 15, 2026
First covered
Jul 1, 2026
Latest story
5 months ago

Summary

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

CWE-1220Insufficient Granularity of Access Control

Attack profile

Attack vectorLocal
ComplexityLow
PrivilegesLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected products

  • Microsoft Defender Antimalware Platform4.0.0.0 to before 4.18.26030.3011

References

CVE.org recordcve.org NVD entrynvd.nist.gov CISA KEV listingcisa.gov Microsoft Defender Elevation of Privilege Vulnerabilitymsrc.microsoft.com
Daily at 7:00 AM Eastern

The 0700 Brief

Every new security and AI story, summarised in one email. Confirm by email, unsubscribe in one click.

43 readers have subscribed