EUVD-2026-56418
GHSA-r3qc-9p9g-q746
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only exploitation requiring a standard user account confirmed by description; C:H reflects sensitive data disclosure; no integrity or availability impact applies.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.
AnalysisAI
Microsoft Defender for Endpoint for Mac exposes sensitive information to low-privileged local users due to a CWE-200 access control failure in versions below 101.26042.0020. A locally authenticated attacker with standard user privileges can access high-confidentiality data handled by the endpoint agent - without any user interaction - making this an insider-threat and post-compromise escalation risk. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available.
Technical ContextAI
CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes a failure to restrict access to sensitive data to only authorized parties. In the context of an endpoint detection and response (EDR) agent like Microsoft Defender for Endpoint, the agent process routinely handles privileged data - including telemetry, process metadata, credentials, or internal configuration - that should be inaccessible to standard OS users. The affected product is exclusively the macOS variant, identified in EUVD data as covering versions 101.0.0 through below 101.26042.0020. The macOS security model relies on process isolation and file permission controls; a disclosure flaw at this layer may stem from overly permissive file or IPC socket permissions created by the agent.
RemediationAI
Upgrade Microsoft Defender for Endpoint for Mac to version 101.26042.0020 or later, which is the confirmed fix version per EUVD data. The vendor patch is available and documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54123. Organizations managing macOS fleets via Microsoft Intune or Endpoint Manager should deploy the update through their standard MDM pipeline. If immediate patching is not feasible, restricting local user account access on macOS hosts running Defender for Endpoint - particularly limiting which users can interact with the agent's IPC or file paths - may reduce exposure, though this is a compensating control with limited effectiveness and should not substitute for patching. Monitoring for unexpected local access to Defender for Endpoint process resources can serve as a detection measure in the interim.
More in Defender For Endpoint
View allMicrosoft Defender for Endpoint on Linux contains a code injection vulnerability that enables adjacent network attackers
Microsoft Defender for Endpoint on Android Spoofing Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is
Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulne
Local privilege escalation in Microsoft Defender for Endpoint for Mac (versions 101.0.0 through 101.26042.0010) allows a
External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privil
Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender al
Microsoft Defender for Endpoint Tampering Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotel
Microsoft Defender for Endpoint Spoofing Vulnerability. Rated medium severity (CVSS 5.9), this vulnerability is remotely
Relative path traversal in Microsoft Defender for Endpoint allows an authorized attacker to perform spoofing locally. Ra
Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today