Microsoft Defender For Endpoint For Mac
Monthly
Local privilege escalation in Microsoft Defender for Endpoint for Mac (versions 101.0.0 up to 101.26042.0020) lets an already-authenticated local user win a time-of-check/time-of-use race to gain higher privileges on the host. The flaw carries a CVSS 7.0 and is reported by Microsoft, which has shipped a fix; there is no public exploit identified at time of analysis and EPSS is low at 0.19% (9th percentile), consistent with CISA's SSVC rating of no observed exploitation. Because the endpoint agent typically runs with elevated system rights, a successful race can promote a standard local account toward root-level control of the security agent itself.
Local privilege escalation in Microsoft Defender for Endpoint for macOS lets an authenticated local attacker exploit a time-of-check-to-time-of-use race to gain elevated privileges. The flaw (CWE-367) requires winning a timing window between when Defender validates a resource and when it acts on it, yielding high confidentiality, integrity, and availability impact. Microsoft has published a fix, and there is no public exploit identified at time of analysis.
Microsoft Defender for Endpoint for Mac exposes private personal information to locally authenticated attackers through an information disclosure flaw tracked as CWE-359. Affected versions span the entire release line below 101.26042.0020, where a low-privileged local attacker operating under high-complexity conditions can read sensitive data that should remain confidential to the security product itself. No public exploit or active exploitation has been identified; SSVC rates the technical impact as partial and exploitation likelihood as none, consistent with the low EPSS score of 0.41% at the 33rd percentile.
Local privilege escalation in Microsoft Defender for Endpoint for Mac (versions 101.0.0 up to 101.26042.0020) lets an already-authenticated local user win a time-of-check/time-of-use race to gain higher privileges on the host. The flaw carries a CVSS 7.0 and is reported by Microsoft, which has shipped a fix; there is no public exploit identified at time of analysis and EPSS is low at 0.19% (9th percentile), consistent with CISA's SSVC rating of no observed exploitation. Because the endpoint agent typically runs with elevated system rights, a successful race can promote a standard local account toward root-level control of the security agent itself.
Local privilege escalation in Microsoft Defender for Endpoint for macOS lets an authenticated local attacker exploit a time-of-check-to-time-of-use race to gain elevated privileges. The flaw (CWE-367) requires winning a timing window between when Defender validates a resource and when it acts on it, yielding high confidentiality, integrity, and availability impact. Microsoft has published a fix, and there is no public exploit identified at time of analysis.
Microsoft Defender for Endpoint for Mac exposes private personal information to locally authenticated attackers through an information disclosure flaw tracked as CWE-359. Affected versions span the entire release line below 101.26042.0020, where a low-privileged local attacker operating under high-complexity conditions can read sensitive data that should remain confidential to the security product itself. No public exploit or active exploitation has been identified; SSVC rates the technical impact as partial and exploitation likelihood as none, consistent with the low EPSS score of 0.41% at the 33rd percentile.