CVE-2026-33825
Microsoft Defender Insufficient Granularity of Access Control Vulnerability
Description
CVE-2026-33825 is a HIGH-severity insufficient granularity of access control vulnerability in Microsoft Defender (the Defender antimalware platform), carrying a CVSS 3.1 score of 7.8. Because Defender's protection mechanism does not enforce access control at a fine-enough level, an authenticated local attacker who already holds low privileges can abuse the flaw to elevate privileges to SYSTEM on the affected Windows host. Successful exploitation of CVE-2026-33825 gives the attacker full control over confidentiality, integrity, and availability of the machine, turning a limited foothold into complete host compromise. CVE-2026-33825 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and is confirmed to be used in ransomware campaigns, and with an EPSS score of 0.06749 (93.2nd percentile) the likelihood of exploitation is well above average — making prompt patching of the Microsoft Defender antimalware platform a priority.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | defender antimalware platform | < 4.18.26030.3011 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825(US Government Resource)
- https://www.huntress.com/blog/nightmare-eclipse-intrusion(Third Party Advisory)
Weakness Type
CWE-1220: Insufficient Granularity of Access Control
CVE-2026-33825 stems from CWE-1220, where Microsoft Defender's access control mechanism is too coarse to properly separate the privileges of different users and processes on the system. Because the protection scheme grants broader access than the principle of least privilege would require, a low-privileged local attacker can reach operations that should be reserved for higher-privileged contexts, enabling local privilege escalation.
Learn more: CWE-1220 — Insufficient Granularity of Access Control
Impact Analysis
CVE-2026-33825 carries a CVSS 3.1 score of 7.8 (HIGH). The attack vector is LOCAL, meaning the attacker must already have local access to the machine rather than exploiting it over the network, but the attack complexity is LOW (easy to exploit, no special conditions needed), it requires only low privileges, and needs no user interaction. A successful exploit yields HIGH impact to confidentiality, integrity, and availability: after escalating privileges the attacker can read any data on the host, tamper with or disable security controls and system files, and disrupt or destroy the system. Although the scope is Unchanged — keeping the direct impact within the compromised host — privilege escalation to SYSTEM is exactly the step attackers need to disable defenses, deploy payloads, and move laterally. Critically, CVE-2026-33825 is confirmed by CISA to be exploited in ransomware operations, so an initial low-privileged foothold can be rapidly converted into full host takeover and encryption; combined with an EPSS score in the 93.2nd percentile, organizations running affected Microsoft Defender versions should treat this vulnerability as an urgent priority.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-33825 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 2026-05-06. The KEV ransomware status is Known, meaning this Microsoft Defender privilege-escalation flaw has been leveraged in ransomware campaigns — a critical signal that attackers use it to disable defenses and escalate to SYSTEM before deploying encryption payloads. The EPSS score of 0.06749 places CVE-2026-33825 in the 93.2nd percentile, indicating exploitation is considerably more likely than for the average CVE. While no reference is tagged as public exploit code, the Huntress "Nightmare Eclipse Intrusion" third-party advisory documents related in-the-wild intrusion activity; organizations should assume exploitation is ongoing and patch immediately.
Remediation
- Apply the vendor update per CISA's KEV directive. CISA's required action is to "apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable," with a remediation deadline of 2026-05-06. Consult the MSRC advisory at msrc.microsoft.com for the specific fix.
- Update the Defender antimalware platform to a fixed build. Upgrade the Microsoft Defender antimalware platform to version 4.18.26030.3011 or later. The antimalware platform typically updates automatically via Microsoft Update or Windows Update; verify the deployed platform version across your fleet and force the update where automatic servicing has stalled.
- Enforce least privilege on affected hosts. Because this is a local privilege escalation, limit which accounts have interactive or local logon rights, remove unnecessary local administrator/standard-user footholds, and apply least-privilege access controls so that a compromised low-privileged account has as little reach as possible.
- Hunt for prior exploitation and ransomware activity. Given confirmed ransomware use, review endpoint and security-event logs for unexpected SYSTEM-level process creation, tampering with or disabling of Defender, and other privilege-escalation indicators. The Huntress "Nightmare Eclipse Intrusion" analysis at huntress.com provides related intrusion detail to inform threat hunting.
- Monitor platform version and defense health long-term. Add the Defender antimalware platform version to your continuous vulnerability management, and alert on any attempts to stop, degrade, or bypass Defender so future access-control weaknesses are caught quickly.
Technical Details
CVE-2026-33825 is a local privilege escalation vulnerability in the Microsoft Defender antimalware platform caused by insufficient granularity of access control (CWE-1220). Coarse-grained access control grants all-or-nothing permissions rather than selectively restricting different users, processes, or agents according to the principle of least privilege; when the protection mechanism cannot distinguish finely between privilege levels, an actor that should only have limited access ends up able to perform operations reserved for a higher-privileged context. In this case a local attacker with low privileges leverages that gap to elevate to SYSTEM. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H shows the attack requires local access and low privileges, has low complexity, needs no user interaction, and achieves full HIGH impact across confidentiality, integrity, and availability with Unchanged scope — the hallmark of a reliable privilege-escalation primitive on the host.
Frequently Asked Questions
Is CVE-2026-33825 being actively exploited?
Yes. CVE-2026-33825 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, with a remediation deadline of 2026-05-06. Its KEV ransomware status is Known, meaning the vulnerability has been used in ransomware campaigns, and its EPSS score of 0.06749 (93.2nd percentile) further indicates elevated exploitation likelihood.
What products are affected by CVE-2026-33825?
The vulnerability affects Microsoft Defender, specifically the Defender antimalware platform in versions prior to 4.18.26030.3011. Organizations should verify the antimalware platform version deployed on their Windows endpoints and prioritize updating any that are below the fixed build.
How do I fix CVE-2026-33825?
Apply Microsoft's fix per the MSRC advisory and update the Defender antimalware platform to version 4.18.26030.3011 or later, as detailed in the Remediation section. Enforce least-privilege access on affected hosts, verify platform versions across the fleet, and hunt for prior privilege-escalation and ransomware activity given confirmed in-the-wild use.
How severe is CVE-2026-33825?
CVE-2026-33825 is rated HIGH with a CVSS 3.1 score of 7.8. It allows a low-privileged local attacker to escalate to full SYSTEM control with no user interaction, achieving HIGH impact to confidentiality, integrity, and availability. Its inclusion in the KEV catalog, confirmed ransomware use, and 93.2nd-percentile EPSS score make it a high-priority vulnerability for immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.