Microsoft Defender Elevation of Privilege Vulnerability (CVE-2026-33825)

What is affected, what to do

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Microsoft Defender Antimalware Platform to version 4.18.26030.3011. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Defender Antimalware Platform lt 4.0.0.0..4.18.26030.3011

Fixed in

• Microsoft Defender Antimalware Platform 4.18.26030.3011

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory the platform version: Query the Defender Antimalware Platform on every Windows endpoint and server (Get-MpComputerStatus | Select AMProductVersion, AMServiceVersion) or pull it from DeviceTvmSoftwareInventory in Defender XDR. The context lists defender_antimalware_platform 4.18.26030.3011 as affected. Treat that build and anything older as vulnerable.
   • Force the platform update: A patch is available from the vendor. Look up the fixed platform version in the MSRC advisory. Push it via Windows Update, WSUS/ConfigMgr or Intune, trigger it manually where needed, then re-verify the version.
   • Clear update blockers: Find hosts stuck on old builds. Common causes are staged or gradual rollout channels, air-gapped segments, and WSUS without the Defender product category approved. On isolated KRITIS networks, apply the offline update package by hand.
   • Prioritise multi-user and pivot hosts: Patch terminal servers, Citrix/AVD hosts, jump boxes and developer workstations first. Many low-privileged accounts have local access there, which is exactly what this privilege escalation needs.
   • Verify Tamper Protection: Enforce it centrally and check it per host (IsTamperProtected). Investigate any host where it is off as potentially compromised.
2. 02

   Runbook step 2

   Mitigation layers

   • IAM / least privilege: Restrict "Allow log on locally" and "Allow log on through Remote Desktop Services" on servers to admin groups only. Rotate local admin passwords with Windows LAPS so a SYSTEM foothold on one host cannot be reused laterally.
   • Application control: Use WDAC or AppLocker to block execution from user-writable paths (%TEMP%, %APPDATA%, C:\Users\Public, and non-vendor folders under C:\ProgramData). This often stops a local exploit binary before it runs.
   • Endpoint hardening: Set ASR rules to block mode, in particular "Block credential stealing from LSASS", "Block process creations originating from PSExec and WMI commands" and "Use advanced protection against ransomware". These limit what an attacker can do after reaching SYSTEM.
   • Defender directory integrity: Baseline the ACLs on C:\ProgramData\Microsoft\Windows Defender\ and C:\Program Files\Windows Defender\ by comparing an icacls export against a reference host. Remediate any user- or group-writable entries immediately.
   • Network segmentation: The vector is local, so the priority is denying initial access. Block RDP (TCP 3389), SMB (TCP 445) and WinRM (TCP 5985/5986) between client VLANs, and route admin access only through PAWs or jump hosts.
   • Central policy: Set DisableLocalAdminMerge so locally added exclusions are ignored.
3. 03

   Runbook step 3

   Detection rules

   • Abnormal children of Defender processes (Sysmon EID 1 / Security 4688 / MDE): DeviceProcessEvents | where InitiatingProcessFileName in~ ("MsMpEng.exe","MpCmdRun.exe","NisSrv.exe","MpDefenderCoreService.exe") and FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe"). A shell spawned under a Defender service is a strong sign of abuse.
   • Defender Operational log: Watch for EID 5001 (real-time protection disabled), 5007 (configuration change, especially new entries under Exclusions\Paths or Exclusions\Processes) and 5013 (Tamper Protection blocked a change). A Sigma rule should alert on EID 5007 where the new value contains Exclusions.
   • Writes to Defender paths (Sysmon EID 11/15, MDE DeviceFileEvents): Alert on file creation or modification under \Windows Defender\ by processes that are not SYSTEM or not Microsoft-signed. Also flag junction or reparse-point creation in C:\ProgramData, for example mklink on the command line followed by Sysmon EID 11.
   • Escalation chain: A process owned by a standard user spawns a child with IntegrityLevel=System, followed shortly by Security 4720 or 4732 (new user, or addition to local Administrators). SPL: index=sysmon EventCode=1 IntegrityLevel=System ParentUser!="NT AUTHORITY\\SYSTEM".
   • Ransomware precursors after reaching SYSTEM: vssadmin delete shadows, wbadmin delete catalog, bcdedit /set recoveryenabled no and Set-MpPreference -DisableRealtimeMonitoring $true (Sysmon EID 1, PowerShell EID 4104).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Source: pwn.watch, cvelistv5, Microsoft Security Update Guide, CISA KEV Catalog, NVD (NIST), ENISA EUVD, CVE.org (MITRE)

Vendors and products

• Microsoft Defender Antimalware Platform

Weakness classes (CWE)

• CWE-1220Insufficient Granularity of Access Control

  Base

  The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

  Entry at MITRE CWE-1220

References & sources

• Microsoft Security Update GuideMicrosoft Defender Elevation of Privilege Vulnerabilityeuvd, Vendor advisory, Patch, pwn-watch
• huntress.comblog/nightmare-eclipse-intrusionThird-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825government-resource
• pwn.watchpwn.watch: Microsoft Defender: Microsoft Defender Insufficient Granularity of Access Control Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-33825pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

One NVD translation into another language is hidden.

Linked advisories

• Researcher’s Disclosures Spotlight Microsoft CVD ProcessSANS NewsBites05.06.2026