CVE-2026-33825: Microsoft Defender Insufficient Access Control -- Local Privilege Escalation

Background

CVE-2026-33825 is a local privilege escalation vulnerability in Microsoft Defender caused by insufficient granularity of access control. An authenticated attacker with limited local access can exploit it to elevate privileges. CISA added it to the Known Exploited Vulnerabilities catalogue on April 22, 2026, confirming active exploitation in the wild.

Like other recent Defender EoP vulnerabilities — notably CVE-2026-41091 added the same week — this is a post-initial-access escalation primitive. Attackers who have obtained low-privilege foothold on a Windows endpoint can use it to reach SYSTEM, unlocking further lateral movement and persistence.

Technical Mechanism

The flaw stems from overly coarse access control on Defender’s internal operations. Security products like Defender run with high privilege and interact extensively with the file system, registry, and process space. When the permission model governing those interactions lacks sufficient granularity, a constrained attacker can craft conditions under which Defender performs a privileged operation on an attacker-influenced resource.

Vulnerability class: Insufficient Granularity of Access Control (CWE-1220). This is distinct from a pure symlink or TOCTOU race but related — it covers scenarios where access decisions are made at too coarse a scope, leaving a gap between what the attacker controls and what the privileged component touches.

The practical exploitation path likely follows a pattern common to AV-based EoP: an attacker places content or structure that Defender will interact with during a scan, quarantine, or remediation operation, and the interaction carries an unintended privilege transfer to attacker-controlled objects.

Real-World Exploitation Evidence

This is a local privilege escalation — not a remote entry point. Exploitation requires an attacker who already has authenticated access to the target machine, typically achieved through:

• Phishing leading to a low-privilege user session
• Exploitation of a separate remote vulnerability for initial access
• Credential compromise granting remote login

Once local access is established, CVE-2026-33825 provides a reliable path from limited user to SYSTEM. This kind of escalation is essential for attackers who need to disable security tooling, access LSASS for credential harvesting, or establish persistence in locations a standard user cannot reach.

Threat intelligence indicates this is being chained with initial access vulnerabilities rather than used in isolation.

Impact Assessment

As a local privilege escalation, this vulnerability is always used as a second stage after an attacker gains initial foothold via any method. Its practical impact is converting any compromised user account into SYSTEM-level access, bypassing Windows user account controls that otherwise contain the breach.

SYSTEM access on Windows endpoints enables credential harvesting from LSASS, disabling or uninstalling security software, and achieving persistence in protected registry locations and system directories. In enterprise environments, SYSTEM on a domain-joined machine provides a launching point for lateral movement and potential domain compromise. The prevalence of Microsoft Defender as the default endpoint protection platform means this escalation path exists across virtually all enterprise Windows estates, making it a broadly applicable post-initial-access primitive.

Affected Versions

The fix is delivered through MMPE (Microsoft Malware Protection Engine) and definition updates rather than a traditional Windows patch. Check your current engine version:

Get-MpComputerStatus | Select-Object AMEngineVersion, AntivirusSignatureLastUpdated

Consult the Microsoft Security Response Center advisory for the specific engine version that includes the fix.

Remediation Steps

1. Patch: Ensure Microsoft Defender is fully updated. In most environments this happens automatically; in managed environments with deferred update policies, force an immediate update:

   Update-MpSignature -UpdateSource MicrosoftUpdateServer
   Get-MpComputerStatus | Select-Object AMEngineVersion

   For enterprise deployments using Microsoft Defender for Endpoint, verify through the MDE portal that engine versions are current across the device inventory. Defender engine updates are delivered as definition updates — any policy that delays or gates these updates will leave endpoints exposed.

2. Workaround: No effective workaround exists. Disabling Defender to avoid exploitation is not a viable mitigation as it eliminates the primary endpoint protection layer.

Detection Guidance

CVE-2026-33825 is a local EoP, so detection focuses on the escalation event and its consequences rather than the exploit mechanism itself.

• Monitor for unexpected SYSTEM-level process creation from standard user sessions: Event ID 4688 with high-privilege parent/child chains where the originating session is a standard user account.
• Defender event logs: Windows Defender logs unexpected quarantine or remediation actions involving user-writable paths.
• Credential access after escalation: LSASS access (Event ID 10 in Sysmon) by non-standard processes following privilege escalation is a key follow-on indicator.
• MMPE version audit: In environments with Defender for Endpoint, alert on devices running outdated engine versions — these are the population at risk.

There are no publicly disclosed IOCs tied to specific exploitation campaigns at this time.

Timeline

References

• NVD — CVE-2026-33825
• CISA KEV — CVE-2026-33825
• Microsoft MSRC — CVE-2026-33825