{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability/$entity","id":"00000000-0000-0000-0000-0000edf04286","releaseDate":"2026-04-14T07:00:00-07:00","cveNumber":"CVE-2026-33825","cveTitle":"Microsoft Defender Elevation of Privilege Vulnerability","releaseNumber":"2026-Apr","vulnType":"Security Vulnerability","latestRevisionDate":"2026-04-30T07:00:00-07:00","description":"<p>Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.</p>\n","cweList":["CWE-1220: Insufficient Granularity of Access Control"],"cweDetailsListForSearch":["cwe: CWE-1220: Insufficient Granularity of Access Control","cweUrl: https://cwe.mitre.org/data/definitions/1220.html"],"unformattedDescription":"Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.","mitreText":"CVE-2026-33825","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2026-33825","publiclyDisclosed":"Yes","exploited":"No","latestSoftwareReleaseId":1,"latestSoftwareRelease":"Exploitation More Likely","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"Microsoft Defender","issuingCna":"Microsoft","issuingCnaId":100000001,"severityId":100000001,"severity":"Important","impactId":100000002,"impact":"Elevation of Privilege","langCode":"en-US","baseScore":"7.8","temporalScore":"7.0","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-1220: Insufficient Granularity of Access Control","https://cwe.mitre.org/data/definitions/1220.html"]}],"articles":[{"title":"Microsoft Defender Elevation of Privilege Vulnerability","articleType":"100000000","description":"<p>Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<table>\n<thead>\n<tr>\n<th>References</th>\n<th>Identification</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Last version of the Microsoft Defender Antimalware Platform affected by this vulnerability</td>\n<td>Version 4.18.26020.6</td>\n</tr>\n<tr>\n<td>First version of the Microsoft Defender Antimalware Platform with this vulnerability addressed</td>\n<td>Version 4.18.26030.3011</td>\n</tr>\n</tbody>\n</table>\n<p>See <a href=\"https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus\">Manage Updates Baselines Microsoft Defender Antivirus</a> for more information.</p>\n<p><strong>Microsoft Defender is disabled in my environment, why are vulnerability scanners showing that I am vulnerable to this issue?</strong></p>\n<p>Vulnerability scanners are looking for specific binaries and version numbers on devices. Microsoft Defender files are still on disk even when disabled. Systems that have disabled Microsoft Defender are not in an exploitable state.</p>\n<p><strong>Why is no action required to install this update?</strong></p>\n<p>In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Windows Defender Antimalware Platform. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.</p>\n<p>For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Windows Defender Antimalware Platform are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.</p>\n<p>Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Windows Defender Antimalware Platform updates and malware definitions, is working as expected in their environment.</p>\n<p><strong>How often are the Microsoft Defender Antimalware Platform and malware definitions updated?</strong></p>\n<p>Microsoft typically releases an update for the Microsoft Defender Antimalware Platform once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.</p>\n<p>Depending on which Microsoft antimalware software is used and how it is configured, the software may search for platform, engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.</p>\n<p><strong>What is the Microsoft Defender Antimalware Platform?</strong></p>\n<p>The Microsoft Defender Antimalware Platform is a collection of user-mode binaries (e.g. MsMpEng.exe) and kernel-mode drivers that run on top of Windows to keep devices protected against new and prevalent threats.</p>\n<p><strong>Microsoft Defender uses the Windows Defender Antimalware Platform. On which products is Defender installed and active by default?</strong></p>\n<p>Defender runs on all supported versions of Windows.</p>\n<p><strong>Are there other products that use the Microsoft Defender Antimalware Platform?</strong></p>\n<p>Yes, Microsoft System Center Endpoint Protection, Microsoft System Center 2012 R2 Endpoint Protection, Microsoft System Center 2012 Endpoint Protection and Microsoft Security Essentials.</p>\n<p><strong>Does this update contain any additional security-related changes to functionality?</strong></p>\n<p>Yes.\u00a0 In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.</p>\n<h2 id=\"suggested-actions\">Suggested Actions</h2>\n<p><strong>Verify that the update is installed</strong></p>\n<p>Customers should verify that the latest version of the Microsoft Malware Protection Platform and definition updates are being actively downloaded and installed for their Microsoft antimalware products.</p>\n<ol>\n<li>Open the Windows Security program. For example, type Security in the Search bar, and select the Windows Security program.</li>\n<li>In the navigation pane, select Virus &amp; threat protection.</li>\n<li>Then click on <strong>Protection Updates</strong> in the Virus &amp; threat protection section updates.</li>\n<li>Select <strong>Check for updates</strong>.</li>\n<li>In the navigation pane, select <strong>Settings</strong>, and then select <strong>About</strong>.</li>\n<li>Examine the <strong>Antimalware ClientVersion</strong> number. The update was successfully installed if the Malware Protection Platform version number or the signature package version number matches or exceeds the version number that you are trying to verify as installed.</li>\n</ol>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>What privileges could be gained by an attacker who successfully exploited this vulnerability?</strong></p>\n<p>An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2026-33825","version":1,"revisionDate":"2026-04-14T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":false,"notificationSent":false,"sourceId":"099510d2-4330-f111-939a-000d3ac5fb71"},{"cveNumber":"CVE-2026-33825","version":1.1,"revisionDate":"2026-04-30T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Added FAQ information. This is an informational change only.</p>\n","unformattedDescription":"Added FAQ information. This is an informational change only.","notificationNeeded":false,"notificationSent":false,"sourceId":"b43c3e6c-a244-f111-93fa-000d3afbc7d7"}]}