CVE-2026-33825
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- Severity
- 7.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 6.75%
- Chance of exploitation in the next 30 days. Higher than 93.97% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Apr 22, 2026
- Weakness
- CWE-1220 Insufficient Granularity of Access Control
- Fix
- None yet
- No fixed version published
Description
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-1220: Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
How to prevent it
- Architecture and Design, Implementation, Testing: Access-control-policy protections must be reviewed for design inconsistency and common weaknesses. Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.
References
Advisories
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| DRUPAL-CONTRIB-2026-167 The Webform module enables site builders to create forms and collect submissions. | Medium | Same weakness, CWE-1220 |
| EEF-CVE-2026-86338 Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle | Not rated yet | Same weakness, CWE-1220 |
| EEF-CVE-2026-78216 AshLua eval read operations can read field-policy-protected fields via aggregates | Not rated yet | Same weakness, CWE-1220 |
| EEF-CVE-2026-78230 AshAi aggregate tool can read field-policy-protected fields | Not rated yet | Same weakness, CWE-1220 |
| CVE-2026-56155 Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally. | High Known exploited | Same weakness, CWE-1220 |
| GHSA-6g26-7cx5-mrrg Keycloak: Information disclosure due to user profile permission bypass | Low | Same weakness, CWE-1220 |
| GHSA-8c7q-86fq-vvmh MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled | Critical | Same weakness, CWE-1220 |
| GHSA-933f-rg6j-f46p Keycloak Account Resources user lookup contains broken access control | Medium | Same weakness, CWE-1220 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor