Read the docs
TI-2026-26195 Aliases CVE-2026-33825GHSA-8vp7-4rmv-4868

Microsoft Defender Elevation of Privilege Vulnerability

Priority CRITICAL 93Exploited in the wildCWE-1220Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.

Summary

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Why it matters now

Exploitation Active In CISA KEV since 2026-04-22CISA due date 2026-05-06Known ransomware use
EPSS 0.06749 94th percentileScored 2026-11-07
Fix Fixed Microsoft Defender Antimalware Platform (Microsoft): 4.18.26030.3011

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Defender Antimalware Platform4.0.0.0 to before 4.18.26030.30114.18.26030.3011Patch availableCNA
  • Microsoft Defender Antimalware Platform VendorMicrosoft Affected 4.0.0.0 to before 4.18.26030.3011 Fixed in 4.18.26030.3011 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:defender_antimalware_platform:*:*:*:*:*:*:*:*before 4.18.26030.3011VulnerableMicrosoft
  • cpe:2.3:a:microsoft:defender_antimalware_platform:*:*:*:*:*:*:*:* Versions before 4.18.26030.3011 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Microsoft Defender Antimalware Platform (Microsoft) Fixed in 4.18.26030.3011

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Elevation of Privilege
Exploited
No
Publicly disclosed
Yes
Exploitability
Exploitation More Likely
ProductStatusPlan or fix
Microsoft Defender Antimalware PlatformFixed 4.18.26030.3011 · Security Update

Timeline

  1. 2026-04-22 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-33825
  3. 2026-10-03 Alias added: GHSA-8vp7-4rmv-4868
  4. 2026-10-25 EPSS moved to the 90th–95th percentile

References

Patch 1

Advisory 1

  • TI-2026-33268 Microsoft Defender Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences