CVE-2026-33825

Description

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Overview

State: PUBLISHED
Assigner (CNA): microsoft
CVSS severity: HIGH
CVSS score: 7.8 / 10
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Effective score: 7.8 / 10 HIGH source: CNA overview
MSRC score: 7.8 / 10 HIGH MS rating: Important · Elevation of Privilege
CWE(s): CWE-1220
Reserved: 2026-03-24
Published: 2026-04-14 07:00 UTC
Last updated: 2026-04-30 07:00 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33825.json
Linked Threat: CVE-2026-33825 — Microsoft Defender: Microsoft Defender Insufficient Granularity of Access Control Vulnerability

CISA Known Exploited Vulnerabilities CISA KEV

CISA has confirmed in-the-wild exploitation of this CVE. Federal agencies must remediate by the due date below; private orgs should treat it as priority-1.

Vulnerability name: Microsoft Defender Insufficient Granularity of Access Control Vulnerability
Vendor / project: Microsoft
Product: Defender
Date added to KEV: 2026-04-22
Remediation due: 2026-05-06
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaign use: Unknown
CISA notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 ; https://nvd.nist.gov/vuln/detail/CVE-2026-33825
CISA listing: www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-04-14 18:17:35 UTC
NVD last modified: 2026-04-23 19:05:04 UTC
NVD CVSS v3.1: 7.8 / 10 HIGH source: secure@microsoft.com
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 1.8 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.0707 (probability of exploitation in next 30 days)
EPSS percentile: 91.61% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-22643
Assigner: microsoft
Published: Apr 14, 2026, 4:57:49 PM
Updated: May 12, 2026, 5:38:43 PM
EUVD base score (CVSS 3.1): 7.8 / 10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
EUVD-reported EPSS: 7.0700
Vendors: Microsoft
Products: Microsoft Defender Antimalware Platform (4.0.0.0 <4.18.26030.3011)
Aliases: GHSA-8vp7-4rmv-4868

ENISA description: Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

EUVD references (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-07-29 03:00 UTC (source: CVRF).

MS severity: Important
Impact: Elevation of Privilege
MS CVSS base score: 7.8 / 10 (temporal 7.0)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Exploit assessment: Publicly Disclosed:Yes;Exploited:No;Latest Software Release:Exploitation More Likely
Release: 2026-Apr

Microsoft remediations / KB articles (2)

Release Notes — Vendor Fix / Security Update (fixed build 4.18.26030.3011)
https://www.microsoft.com/en-us/wdsi/defenderupdates — None Available / Release Notes

Microsoft FAQ (2)

References	Identification
Last version of the Microsoft Defender Antimalware Platform affected by this vulnerability	Version 4.18.26020.6
First version of the Microsoft Defender Antimalware Platform with this vulnerability addressed	Version 4.18.26030.3011

See Manage Updates Baselines Microsoft Defender Antivirus for more information.

Microsoft Defender is disabled in my environment, why are vulnerability scanners showing that I am vulnerable to this issue?

Vulnerability scanners are looking for specific binaries and version numbers on devices. Microsoft Defender files are still on disk even when disabled. Systems that have disabled Microsoft Defender are not in an exploitable state.

Why is no action required to install this update?

In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Windows Defender Antimalware Platform. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.

For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Windows Defender Antimalware Platform are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.

Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Windows Defender Antimalware Platform updates and malware definitions, is working as expected in their environment.

How often are the Microsoft Defender Antimalware Platform and malware definitions updated?

Microsoft typically releases an update for the Microsoft Defender Antimalware Platform once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.

Depending on which Microsoft antimalware software is used and how it is configured, the software may search for platform, engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.

What is the Microsoft Defender Antimalware Platform?

The Microsoft Defender Antimalware Platform is a collection of user-mode binaries (e.g. MsMpEng.exe) and kernel-mode drivers that run on top of Windows to keep devices protected against new and prevalent threats.

Microsoft Defender uses the Windows Defender Antimalware Platform. On which products is Defender installed and active by default?

Defender runs on all supported versions of Windows.

Are there other products that use the Microsoft Defender Antimalware Platform?

Yes, Microsoft System Center Endpoint Protection, Microsoft System Center 2012 R2 Endpoint Protection, Microsoft System Center 2012 Endpoint Protection and Microsoft Security Essentials.

Does this update contain any additional security-related changes to functionality?

Yes. In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.

Suggested Actions

Verify that the update is installed

Customers should verify that the latest version of the Microsoft Malware Protection Platform and definition updates are being actively downloaded and installed for their Microsoft antimalware products.

Open the Windows Security program. For example, type Security in the Search bar, and select the Windows Security program.
In the navigation pane, select Virus & threat protection.
Then click on Protection Updates in the Virus & threat protection section updates.
Select Check for updates.
In the navigation pane, select Settings, and then select About.
Examine the Antimalware ClientVersion number. The update was successfully installed if the Malware Protection Platform version number or the signature package version number matches or exceeds the version number that you are trying to verify as installed.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Affected products (1)

Vendor	Product	Versions	Platforms
Microsoft	Microsoft Defender Antimalware Platform	`4.0.0.0` (affected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:microsoft:defender_antimalware_platform:*:*:*:*:*:*:*:*

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

Microsoft Defender Elevation of Privilege Vulnerability vendor-advisorypatch

Web references (6)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

None Available msrc
http://cwe.mitre.org/data/definitions/1220.html rapid7:cwe.mitre.org
https://attackerkb.com/topics/CVE-2026-33825 rapid7:attackerkb.com
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22643 rapid7:euvd.enisa.europa.eu
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 rapid7:msrc.microsoft.com
https://www.cve.org/CVERecord?id=CVE-2026-33825 rapid7:www.cve.org

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 secure@microsoft.com Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825 134c704f-9b21-4f2e-91b3-4a467353bcc0 US Government Resource
https://www.huntress.com/blog/nightmare-eclipse-intrusion 134c704f-9b21-4f2e-91b3-4a467353bcc0 Third Party Advisory

Indicators (2)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
cve	`CVE-2026-33825`	no local data	2026-05-14 02:58 UTC
cwe	`CWE-1220`	no local data	2026-05-14 02:58 UTC

Remediations (9)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

RedSun: When Windows Defender Becomes the Attacker's Ladder

web:www.whitecloudsecurity.com

Key Takeaways CVE-2026-33825 allows a low-privilege local user to escalate to NT AUTHORITY\SYSTEM via a logic flaw in Windows Defender's access control. RedSun is a publicly released PoC that proves the vulnerability is exploitable — lowering the bar for anyone who wants to test or weaponize it. Microsoft patched the flaw in the April 2026 Patch Tuesday cycle. Patching is the correct first ...

2026-05-14 07:48 UTC
CVE-2026-33825 Exploitation Elevates Breach Det… | PurpleOps

web:purple-ops.io

Mitigation requires immediate patching of CVE-2026-33825 and CVE - 2026 -1731, with strict application control and EDR monitoring. Frequently Asked Questions What is CVE-2026-33825 and why is it critical? CVE-2026-33825 SYSTEM Which tools are associated with the exploitation of CVE-2026-33825 ?

2026-05-14 07:48 UTC
CVE-2026-33825: Microsoft Defender Access Control Exploitation ...

web:securityarsenal.com

CISA flags CVE-2026-33825 in Microsoft Defender with active exploitation. Immediate patching and EDR configuration auditing are required to prevent bypass.

2026-05-14 07:48 UTC
Apr 2026: Microsoft Defender Elevation of Privilege Vulnerability

web:stack.watch

The following remediation steps are recommended / required by May 6, 2026 : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

2026-05-14 07:48 UTC
CISA orders feds to patch BlueHammer flaw exploited as zero-day

web:www.bleepingcomputer.com

CISA has ordered U.S. federal agencies to patch a Microsoft Defender privilege escalation flaw (dubbed BlueHammer) that has been exploited in zero-day attacks.

2026-05-14 07:48 UTC
Nvd - Cve-2026-33825

web:nvd.nist.gov

An official website of the United States government NVD MENU

2026-05-14 07:48 UTC
CVE-2026-33825 - Elevate Privileges Using Access Control Flaws in ...

web:www.cve.news

A newly identified security vulnerability — CVE-2026-33825 — has recently shaken the cybersecurity community. This issue reveals that Microsoft Defender, the default security tool in Windows, has an oversight in its access control settings, allowing any authorized user on a machine to locally escalate their privileges.

2026-05-14 07:48 UTC
CVE-2026-33825: Microsoft Defender Privilege Escalation

web:www.sentinelone.com

CVE-2026-33825 is a privilege escalation vulnerability in Microsoft Defender caused by insufficient access control granularity. This article covers the technical details, affected versions, impact, and mitigation .

2026-05-14 07:48 UTC
CISA Required Action

CISA KEV

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-05-06 Known ransomware campaign use: Unknown

2026-05-14 01:13 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-33825.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33825",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-23T03:55:45.505705Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-04-22",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-23T12:41:44.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://www.huntress.com/blog/nightmare-eclipse-intrusion"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Microsoft Defender Antimalware Platform",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.18.26030.3011",
              "status": "affected",
              "version": "4.0.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:microsoft_defender:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.18.26030.3011",
                  "versionStartIncluding": "4.0.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-04-14T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1220",
              "description": "CWE-1220: Insufficient Granularity of Access Control",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T17:38:43.822Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Defender Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825"
        }
      ],
      "title": "Microsoft Defender Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-33825",
    "datePublished": "2026-04-14T16:57:49.361Z",
    "dateReserved": "2026-03-24T00:52:01.352Z",
    "dateUpdated": "2026-05-12T17:38:43.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}