What is the CVSS score of CVE-2026-50658?

CVE-2026-50658 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Microsoft Defender For Endpoint For Mac are affected by CVE-2026-50658?

Microsoft Defender for Endpoint for macOS contains a privilege escalation vulnerability allowing local attackers with system access to gain administrative control, undermining endpoint security…. A patch is available.

How to fix or mitigate CVE-2026-50658?

Within 24 hours, inventory all macOS endpoints running Microsoft Defender for Endpoint to establish baseline deployment scope and identify high-value systems. Within 7 days, apply the available security patch to all affected macOS systems through standard patch management procedures, prioritizing administrative and sensitive data access systems. Within 30 days, verify 100% patch compliance across your macOS environment and enable automated update delivery from Microsoft to ensure rapid deployment of future security fixes.

Microsoft Defender For Endpoint For Mac CVE-2026-50658

EUVD-2026-44121 HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-07-14 microsoft

GHSA-crrx-464g-pwj8

Microsoft Information Disclosure Microsoft Defender For Endpoint For Mac

7.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:49 vuln.today

CVE Published

Jul 14, 2026 - 17:08 nvd

HIGH 7.0

DescriptionCVE.org

Time-of-check time-of-use (toctou) race condition in Microsoft Defender allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Defender for Endpoint for macOS lets an authenticated local attacker exploit a time-of-check-to-time-of-use race to gain elevated privileges. The flaw (CWE-367) requires winning a timing window between when Defender validates a resource and when it acts on it, yielding high confidentiality, integrity, and availability impact. Microsoft has published a fix, and there is no public exploit identified at time of analysis.