EUVD-2026-22643
GHSA-8vp7-4rmv-4868
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
11DescriptionCVE.org
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Articles & Coverage 1
AnalysisAI
Privilege escalation in Microsoft Defender Antimalware Platform versions before 4.18.26030.3011 allows authenticated local attackers to gain elevated system privileges through insufficiently granular access controls. CVSS 7.8 (High) reflects local attack vector requiring low privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must possess valid low-privileged local user credentials on a Windows system running vulnerable Microsoft Defender Antimalware Platform version 4.0.0.0 through 4.18.26030.3010. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk assessment reveals moderate-to-high technical severity but limited exploitation likelihood based on multi-source signals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already compromised a standard user account on a Windows system (through phishing, stolen credentials, or other means) executes a malicious script or binary that exploits the insufficient access controls in Microsoft Defender Antimalware Platform. By leveraging the overly permissive access boundaries within Defender's platform components, the attacker manipulates platform resources or injects code into privileged Defender processes to gain SYSTEM-level execution. … |
| Remediation | Update Microsoft Defender Antimalware Platform to version 4.18.26030.3011 or later, available through Microsoft's automatic update mechanism for the antimalware platform. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running Microsoft Defender Antimalware Platform and identify current versions via Windows Update or Microsoft Defender management console. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today