CVE-2026-102204
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker could exploit file links to gain elevated privileges, potentially leading to system takeover.
Recommendation
Apply the latest Microsoft Defender for Endpoint security updates.
Other vulnerabilities in Microsoft Defender for Endpoint
See all- CVE-2026-54123Medium
Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.
- CVE-2026-56178Medium
Microsoft Defender for Endpoint contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that allows an authorized attacker to elevate privileges locally.
- CVE-2026-45647Medium
Microsoft Defender for Endpoint has a time-of-check time-of-use (TOCTOU) race condition vulnerability. An authorized attacker can elevate privileges locally.
- CVE-2023-21809High
Security feature bypass vulnerability in Microsoft Defender for Endpoint.
Original NVD description (English source)
Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS