CVE-2026-56178
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Microsoft Defender for Endpoint contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that allows an authorized attacker to elevate privileges locally.
Risk Assessment
The risk involves the possibility of privilege escalation by an authorized attacker, which could lead to system compromise.
Recommendation
It is recommended to apply the appropriate security update from Microsoft for Microsoft Defender for Endpoint.
Other vulnerabilities in Microsoft Defender for Endpoint
See all- CVE-2026-54123Medium
Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.
- CVE-2026-45647Medium
Microsoft Defender for Endpoint has a time-of-check time-of-use (TOCTOU) race condition vulnerability. An authorized attacker can elevate privileges locally.
- CVE-2023-21809High
Security feature bypass vulnerability in Microsoft Defender for Endpoint.
Original NVD description (English source)
Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.