Microsoft Defender Local Privilege Escalation (CVE-2026-33825)

Historical catalog analysis: CISA added this entry on April 22, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-33825 is an insufficient granularity of access control vulnerability (CWE-1220) affecting Microsoft Defender. The flaw allows an attacker who already possesses authorized access to the system to escalate their privileges locally.

Exposure and applicability

This vulnerability applies to environments deploying Microsoft Defender. Because this is a local privilege escalation (LPE) flaw, the primary exposure path requires the attacker to have already established a foothold on the target endpoint. However, the risk profile is elevated because the vulnerability has been identified for use in known ransomware campaigns, where LPE is often used to disable security software or deploy payloads with system-level permissions.

Remediation priorities

Based on the reported exploitation status, remediation should be prioritized for high-value assets and endpoints with broad user access. Our analysis suggests the following priority sequence:

1. Immediate Patching: Apply vendor-supplied mitigations as specified in Microsoft’s instructions. This is the primary method to address the underlying access control flaw.
2. Cloud Service Alignment: For organizations utilizing Defender via cloud services, ensure alignment with BOD 22-01 guidance where applicable to manage service-level exposure.
3. Asset Decommissioning: In scenarios where mitigations are unavailable or cannot be applied to legacy systems, the source suggests discontinuing use of the product to eliminate the attack surface.

How to validate remediation

Verification must move beyond simple version checks, as a deployed update does not always guarantee that the vulnerability is neutralized in the active runtime environment. To verify that exposure has been reduced, defenders should:

• Confirm Mitigation Application: Verify through configuration management tools that the specific vendor-recommended updates or registry changes are present across all targeted endpoints.
• Privilege Audit: Conduct a review of local account permissions to ensure no unauthorized accounts have gained elevated privileges during the window of exposure.
• Functional Testing: In a controlled environment, validate that the updated Defender instance maintains its security posture without allowing the specific access control bypass described in the vendor’s technical guidance.

Limits and open questions

While patching reduces the likelihood of exploitation, residual risk remains if an attacker has already achieved persistence on a system prior to the update. The source does not specify the exact version range of Microsoft Defender affected or provide a detailed exploit chain; therefore, defenders must rely on vendor-specific documentation for precise version identification. Furthermore, because this is an LPE vulnerability, it does not address how the initial authorized access was obtained, meaning perimeter and identity controls remain critical dependencies.

Source and editorial note

CVE-2026-33825: Microsoft Defender Insufficient Granularity of Access Control Vulnerability · Source date: April 22, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: April 25, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 13, 2026 at 00:46 UTC.

Request a Vulnerability Assessment