What is the CVSS score of CVE-2026-21537?

CVE-2026-21537 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Defender For Endpoint are affected by CVE-2026-21537?

A critical code injection vulnerability in Microsoft Defender for Linux (CVE-2026-21537, CVSS 8.8) enables attackers on adjacent networks to execute arbitrary code without authorization.. A patch is available.

How to fix or mitigate CVE-2026-21537?

Within 24 hours: Identify and inventory all Linux systems running Microsoft Defender; assess network exposure by documenting adjacent network access points and data sensitivity of affected systems. Within 7 days: Implement network segmentation to restrict adjacent network access to affected Linux hosts; disable Microsoft Defender if operationally feasible pending patch availability; increase monitoring for suspicious process execution on affected systems. Within 30 days: Maintain weekly vendor contact for patch availability; evaluate alternative endpoint protection solutions; conduct forensic analysis on systems for signs of exploitation.

Defender For Endpoint CVE-2026-21537

HIGH

Code Injection (CWE-94)

2026-02-10 secure@microsoft.com

Linux Microsoft Code Injection Defender For Endpoint

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 8.8

DescriptionCVE.org

Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network.

AnalysisAI

Microsoft Defender for Endpoint on Linux contains a code injection vulnerability that enables adjacent network attackers to execute arbitrary code without authentication. The flaw affects multiple platforms and carries high severity (CVSS 8.8) with no patch currently available. An attacker on the local network could achieve complete system compromise through this unauthenticated attack vector.

Technical ContextAI

Classified as CWE-94 (Code Injection). Affects Defender For Endpoint. Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network.