EUVD-2026-44120
GHSA-f9xj-xpm5-pgx4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only access, low-privilege account required, high complexity gate, and purely confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.
AnalysisAI
Microsoft Defender for Endpoint for Mac exposes private personal information to locally authenticated attackers through an information disclosure flaw tracked as CWE-359. Affected versions span the entire release line below 101.26042.0020, where a low-privileged local attacker operating under high-complexity conditions can read sensitive data that should remain confidential to the security product itself. No public exploit or active exploitation has been identified; SSVC rates the technical impact as partial and exploitation likelihood as none, consistent with the low EPSS score of 0.41% at the 33rd percentile.
Technical ContextAI
The affected product is Microsoft Defender for Endpoint for Mac, identified by CPE cpe:2.3:a:microsoft:microsoft_defender_for_endpoint_for_mac:*:*:*:*:*:*:*:*, covering all releases from 101.0.0 up to but not including 101.26042.0020. The root cause is CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor), which describes a failure to adequately restrict access to personally identifiable or otherwise sensitive data that the software handles internally. On macOS endpoint agents, such data may include telemetry, scan logs, configuration details, or user-identifying artifacts stored on disk or in inter-process communication channels accessible to non-root local users. The local attack vector and high complexity suggest that exploitation requires a specific race condition, file-path traversal, or privileged IPC interaction that a low-privileged user can trigger but that is not trivially reproducible.
RemediationAI
The primary remediation is to update Microsoft Defender for Endpoint for Mac to version 101.26042.0020 or later, which Microsoft has confirmed resolves this vulnerability per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50657. Administrators managing endpoints through Microsoft Intune, JAMF, or similar MDM platforms should push the update via their standard macOS endpoint management workflow and confirm the agent build number reflects the patched release. If immediate patching is not feasible, compensating controls should focus on restricting local user access on macOS endpoints: enforce least-privilege macOS user accounts so that standard users cannot access Defender's working directories (typically under /Library/Application Support or /var), enable Full Disk Access only for trusted administrative accounts, and audit local user membership on sensitive endpoints. Note that these controls reduce but do not eliminate local access risk and are not a substitute for the vendor patch.
Local privilege escalation in Microsoft Defender for Endpoint for macOS lets an authenticated local attacker exploit a t
Local privilege escalation in Microsoft Defender for Endpoint for Mac (versions 101.0.0 up to 101.26042.0020) lets an al
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today