Microsoft Defender CVE-2026-70264

Exploitation requires the attacker to already hold a local, authenticated low-privileged account on the Windows host (CVSS PR:L, AV:L) - this is not remotely reachable. The attacker must be able to create or control a filesystem link (symbolic or hard link, per CWE-59) that a Microsoft Defender file-access operation then resolves, causing Defender to read a file on the attacker's behalf. Limiting factors: no remote vector, prior local access is mandatory, impact is confined to information disclosure (no write/integrity or availability effect), and affected deployments are those running Windows Defender platform versions below 1.1.26090.9; updating to that build removes the condition.

This is a genuine-but-moderate priority, not a drop-everything issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-complexity attack requiring an already-authenticated low-privileged account, yielding high confidentiality impact only (no integrity or availability loss). All exploitation signals point low: CISA SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', which is internally consistent with the local, single-system, info-disclosure nature of CWE-59 link-following. No EPSS score was supplied in the input, the CVE is not on CISA KEV, and no public proof-of-concept is referenced - so exploitation is unconfirmed on every available signal. The main real-world consideration is prevalence rather than exploitability: Microsoft Defender ships on essentially every modern Windows endpoint, so the installed base is enormous even though the attack itself requires prior local access and only leaks information. No signals conflict here; the picture is coherent (low exploitation likelihood, high deployment, limited impact). Note that EPSS is absent, so probabilistic exploitation likelihood cannot be quoted.

A low-privileged user (or malware already running under such an account) on a Windows host plants or manipulates a symbolic/hard link so that a Microsoft Defender operation follows it and accesses a file the attacker should not be able to read, disclosing its contents. Exploitation is entirely local and requires an existing foothold, with no user interaction. No public exploit code is referenced for this CVE.