EUVD-2026-100358
GHSA-cc23-mrxf-w2c6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local authenticated low-priv access
-
ExploitPlant malicious symlink/junction at monitored path
-
ExecutionDefender resolves link during privileged file op
-
ImpactEscalate to SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Requires an attacker who already has local, authenticated low-privileged code execution on the host (PR:L, AV:L) and the ability to create symbolic links, NTFS junctions, or hardlinks at a filesystem path that Microsoft Defender for Endpoint operates on with higher privilege. The flaw is triggered when Defender's privileged process follows the attacker-controlled link during a file access (CWE-59), so exploitation is bounded to the local machine and typically involves winning a timing window or staging the link before Defender's operation. Limiting factors: the attacker must already have a foothold on the endpoint, so this cannot be used for initial remote access; no user interaction is required (UI:N), and no special Defender configuration is indicated by the description, meaning default-deployed Defender for Endpoint installations are likely in scope. |
| Impact | This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-complexity, authenticated-user privilege escalation with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with a link-following (CWE-59) flaw that lets an already-present low-privileged user escalate, typically to SYSTEM, by abusing Microsoft Defender for Endpoint's privileged file operations. Because the attack vector is Local and requires existing privileges (PR:L), this is a post-compromise escalation primitive, not a remotely reachable entry point. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was referenced, so this is 'no public exploit identified at time of analysis.' There is no SSVC data supplied. The signals are internally consistent (local EoP with full impact), so there is no contradiction to flag - but the absence of EPSS/KEV/POC means real-world exploitation likelihood cannot be quantified from the provided data and should be treated as unknown rather than low. Note one metadata conflict: the input Tags label this 'Information Disclosure,' which contradicts the description (local privilege elevation) and the C:H/I:H/A:H vector - verify classification against MSRC. |
| Exploit ScenarioDerived | A low-privileged user already authenticated on a Windows endpoint plants a malicious symbolic link, junction, or hardlink at a path that Microsoft Defender for Endpoint later accesses with elevated privileges. When Defender resolves the link during a privileged file operation, it reads, writes, or deletes an attacker-chosen target it should not touch, allowing the user to escalate to SYSTEM-level control. No public exploit code was identified in the provided data, and no user interaction is required once the attacker has local access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in Microsoft Defender for Endpoint allows an authenticated attacker who already holds low-privileged code execution on the host to elevate to a higher-privileged context by planting a symbolic link, NTFS junction, or hardlink at a filesystem path that Defender's privileged components later resolve and follow (CWE-59). The prerequisite is a local, authenticated foothold (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8); no user interaction is required, and no special Defender configuration is implied, so default deployments are likely in scope. There is no public exploit code and no confirmed active exploitation at time of analysis, and this is assessed as a credible but not emergency-tier priority given that the flaw cannot be used for initial remote access and is bounded to the local machine.
RemediationAI
The primary fix is the Microsoft security update published through the MSRC update guide for CVE-2026-102204, referenced in the supplied data; an exact patched build or platform version was not present in the available intelligence, so consult the advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102204 to obtain the specific fixed build for your Defender for Endpoint platform and engine channel and apply it through your normal Defender update mechanism (Microsoft Update, Microsoft Defender for Endpoint security intelligence updates, or the platform update KB listed by MSRC). Because no vendor-released patch version is confirmed in this dataset, treat patch availability as unconfirmed and verify against the MSRC advisory before assuming remediation is complete. Where patching is delayed, apply targeted compensating controls that address the link-following precondition rather than generic hardening: restrict write access to Defender-managed directories and any path Defender services traverse with elevated rights, since an attacker who cannot create or modify a directory entry cannot stage the reparse point - the trade-off is that over-tightening ACLs can disrupt quarantine, definition updates, or log rollover. Audit and, where operationally feasible, reduce who holds SeCreateSymbolicLinkPrivilege; note that this only partially mitigates the issue because unprivileged users can still create NTFS junctions and hardlinks on many configurations, so this control reduces but does not eliminate exploitability. Enable Windows Object Access auditing for file-system reparse-point creation and monitor for symlink or junction creation targeting Defender install, quarantine, or program-data paths, accepting the noise cost of additional 4663/4664 events. Ensure Defender tamper protection and, where supported, the platform's anti-tampering settings are enabled so a lower-privileged process cannot disable or reconfigure Defender components during an attempt; tamper protection does not block the link-following primitive itself. Finally, because the vulnerability requires an existing local foothold, prioritize detection and containment of low-privileged local code execution on endpoints as the highest-leverage preventive measure, since eliminating the foothold removes the prerequisite entirely.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-59, improper link resolution before file access, commonly described as a link-following or reparse-point vulnerability. On Windows, symlinks, NTFS junctions, and hardlinks are reparse points that redirect a filesystem path to another location; when a privileged process performs a file operation without first resolving or validating the reparse point, it can be tricked into reading, writing, overwriting, or deleting a file it would not otherwise be permitted to touch. Microsoft Defender for Endpoint runs high-privilege services (antimalware engine, EDR sensor, and supporting updater/quarantine/telemetry components) that routinely scan, quarantine, and remediate files in user-writable locations, which creates the opportunity for an attacker who controls a path element to insert a link and have the privileged service follow it. Exploitation is effectively a controlled-toctou race: the attacker either stages the link before the Defender operation or wins a timing window, and success yields a high-integrity file operation. Consistent with the assessed vector, the attack surface is local only (AV:L) and requires an existing low-privileged execution context (PR:L); there is no network vector, no privilege boundary crossed by unauthenticated parties, and no user interaction (UI:N) is needed. No CPE data or affected version ranges were supplied with this record beyond the vendor advisory reference.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local link-following EoP by an authenticated low-priv user (AV:L, PR:L, AC:L, UI:N) yielding SYSTEM-level control, so C/I/A all High and scope Unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity local privilege escalation flaw in Microsoft Defender for Endpoint allows an attacker who already has a low-privileged foothold on a Windows host to escalate to higher-privileged system context by manipulating filesystem link objects that Defender's privileged components follow. Because the flaw sits in the security agent itself, default Defender for Endpoint deployments are likely in scope, meaning the control organizations rely on for endpoint protection could be turned into a stepping stone for deeper compromise. Leadership should care because this amplifies the damage of any existing host compromise - it does not by itself grant remote access - so risk is concentrated on endpoints where an attacker has already landed.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce least privilege and remove unnecessary local admin rights to shrink the pool of hosts where an authenticated low-privileged foothold can be escalated; restrict and monitor write access to Defender installation, configuration, and log directories; enable tamper protection and full EDR telemetry; configure Sysmon and Windows object-access auditing to alert on symbolic link, NTFS junction, and hardlink creation in Defender-controlled paths; and prioritize remediation of any pre-existing host compromise, since the flaw cannot be reached without an initial local foothold. Apply the vendor patch as soon as it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB