CVE-2026-33825
KEVRansomware UseMicrosoft Defender Insufficient Granularity of Access Control Vulnerability
Description
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HPublishedApr 14, 2026
Last modifiedJul 24, 2026
Added to KEVApr 22, 2026
Remediation dueMay 6, 2026
References
- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825Vendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825US Government Resource
- huntress.com/blog/nightmare-eclipse-intrusionThird Party Advisory
0 recent articles mention this CVE
80
Risk assessment · Critical
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 174 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 7.8 HIGH
- EPSS (30-day exploit probability)
- 6.7% · top 6% of all CVEs
- Weakness
- CWE-1220
Recommended actions
- 1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 4.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.