EUVD-2026-44253
GHSA-2q3v-wwm5-c8hw
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user (PR:L, AV:L) must win a non-deterministic TOCTOU race (AC:H) with no victim interaction; success yields full control of the privileged agent (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Defender for Endpoint for Mac (versions 101.0.0 up to 101.26042.0020) lets an already-authenticated local user win a time-of-check/time-of-use race to gain higher privileges on the host. The flaw carries a CVSS 7.0 and is reported by Microsoft, which has shipped a fix; there is no public exploit identified at time of analysis and EPSS is low at 0.19% (9th percentile), consistent with CISA's SSVC rating of no observed exploitation. Because the endpoint agent typically runs with elevated system rights, a successful race can promote a standard local account toward root-level control of the security agent itself.
Technical ContextAI
The root cause is CWE-367 (Time-of-check Time-of-use race condition): the software validates a resource - such as a file path, symlink, or object handle - and then acts on it, but the state can be altered by another thread or process in the interval between the check and the use. In Microsoft Defender for Endpoint for Mac (CPE cpe:2.3:a:microsoft:microsoft_defender_for_endpoint_for_mac), a privileged component performs an operation on a resource whose properties were validated moments earlier; by manipulating that resource concurrently (for example swapping a file for a symlink), an attacker can cause the privileged process to act on an unintended target. On macOS this class of bug in an endpoint agent is significant because the agent runs as a system daemon with broad filesystem and process access, so a controlled race can translate into privileged file writes or execution.
RemediationAI
Vendor-released patch: update Microsoft Defender for Endpoint for Mac to version 101.26042.0020 or later, which resolves the race condition; this is the primary and recommended fix per the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56178. In managed environments, push the updated agent build through your MDM (Intune/Jamf) or Microsoft's automatic Defender update channel and confirm the reported product version on endpoints after deployment. No standalone workaround is documented; as an interim compensating control, limit interactive and standard-user local access to Mac endpoints and monitor for anomalous local privilege-escalation activity, accepting that this reduces but does not eliminate the local attack surface until the agent is upgraded.
Local privilege escalation in Microsoft Defender for Endpoint for macOS lets an authenticated local attacker exploit a t
Microsoft Defender for Endpoint for Mac exposes private personal information to locally authenticated attackers through
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today