Actively exploited in the wild
Microsoft Defender Insufficient Granularity of Access Control Vulnerability
Microsoft - Defender · Listed in the CISA KEV since 2026-04-22. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-33825
HighCVSS 7.8KEVExploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Risk Assessment
An authorized user can escalate privileges, potentially leading to system integrity compromise and access to protected resources.
Recommendation
Apply the latest Microsoft Defender security updates available via Windows Update.
Other vulnerabilities in Microsoft Defender
See all- CVE-2026-45498MediumActively exploited
Microsoft Defender Denial of Service Vulnerability.
- CVE-2026-41091HighActively exploited
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- CVE-2021-42298High
Remote code execution vulnerability in Microsoft Defender. An attacker could exploit this vulnerability to execute arbitrary code on the system.
- CVE-2026-50658High
A Time-of-check time-of-use (TOCTOU) race condition in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- CVE-2026-50657Medium
In Microsoft Defender, exposure of private personal information to an unauthorized actor allows an authorized attacker to disclose information locally.
- CVE-2026-55012High
An integer overflow or wraparound vulnerability has been discovered in Microsoft Defender. This flaw allows an unauthorized attacker to execute code locally.
- CVE-2026-55011High
An integer underflow (wrap or wraparound) vulnerability in Microsoft Defender allows an unauthorized attacker to execute code locally.
- CVE-2026-45584High
Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.
- CVE-2023-33156Medium
A vulnerability in Microsoft Defender allows for elevation of privilege, potentially leading to unauthorized access to the system.
- CVE-2021-34471High
Elevation of privilege vulnerability in Microsoft Defender. An attacker could exploit it to gain elevated privileges.
Original NVD description (English source)
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.