CVE-2026-33825 - Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Vulnerability Name

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Description

Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825

https://nvd.nist.gov/vuln/detail/CVE-2026-33825

Related News Articles

Critical Windows Netlogon RCE flaw now exploited in attacksJune 1, 2026

Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account RemovalMay 28, 2026

Microsoft Defender vulnerabilities exploited in the wild (CVE-2026-41091, CVE-2026-45498)May 21, 2026

Microsoft shares mitigation for YellowKey Windows zero-dayMay 20, 2026

New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC releasedMay 18, 2026