CVE-2026-33825

What it actually does

This is a local privilege escalation vulnerability in the Microsoft Defender antimalware platform caused by insufficiently granular access control. An attacker who already has authorized local access can abuse Defender-controlled components, permissions, or trust boundaries to gain higher privileges on the affected Windows system. The CVSS vector indicates low attack complexity, no user interaction, and high impact to confidentiality, integrity, and availability once exploited.

Why it matters to the business

Successful exploitation can turn a low-privileged foothold into administrative or SYSTEM-level control, allowing attackers to disable security controls, access sensitive data, deploy ransomware, move laterally, or persist on critical endpoints and servers. Because this vulnerability is listed in CISA KEV, marked as actively exploited in the wild, and associated with ransomware activity, remediation should be treated as urgent; CISA’s listed remediation deadline is 2026-05-06. Organizations with broad Microsoft Defender deployment have wide potential exposure because the affected component is commonly present across Windows estates.

How an attack unfolds

An attacker first obtains local access to a Windows system through phishing, stolen credentials, malware execution, remote access abuse, or another vulnerability. From that low-privileged context, the attacker targets the vulnerable Microsoft Defender antimalware platform behavior and abuses the access-control weakness to cross a local privilege boundary. Once elevated, the attacker can execute commands with higher privileges, tamper with Defender settings, add exclusions, stop or weaken protections, dump credentials, install persistence, and deploy additional payloads. In ransomware-driven intrusions, this type of flaw is especially valuable because it helps the attacker neutralize endpoint defenses before encryption or broader lateral movement. Reported exploitation context includes BlueHammer activity and active in-the-wild exploitation of this Microsoft Defender access-control vulnerability.

How to fix it

Update the Microsoft Defender antimalware platform through Microsoft security updates and Defender platform updates as soon as available. No exact fixed version was provided in the input, so systems should be brought to the latest Microsoft Defender antimalware platform, engine, and security intelligence versions recommended by Microsoft for this vulnerability. Ensure automatic Defender platform updates are enabled, verify Windows Update / Microsoft Update connectivity, and prioritize internet-facing systems, privileged-user workstations, servers, and systems used for administration. Where immediate patching is not possible, reduce local logon rights, remove unnecessary administrative access, enforce application control, monitor and restrict Defender configuration changes, prevent unauthorized service creation and scheduled task creation, and use EDR controls to detect privilege escalation and Defender tampering attempts.

How to confirm the fix worked

Confirm the installed Microsoft Defender antimalware platform version is at or above the Microsoft-recommended fixed release for this vulnerability. On Windows systems, use Microsoft Defender management tooling, endpoint management inventory, PowerShell such as Get-MpComputerStatus, or enterprise vulnerability management data to review Defender platform, engine, and security intelligence versions. Validate that Defender services are running, tamper protection is enabled where supported, exclusions are authorized, and no unexpected Defender policy changes exist. Re-scan affected assets after update deployment and verify that vulnerability scanners no longer identify the Microsoft Defender antimalware platform as vulnerable.

Typical attack path

1. Gain initial local code execution or an interactive session on a Windows endpoint or server.
2. Confirm Microsoft Defender antimalware platform is present and vulnerable.
3. Invoke the local privilege escalation technique against the Defender component or its access-control boundary.
4. Obtain elevated privileges, commonly administrator or SYSTEM-equivalent execution.
5. Modify or disable security controls, including Defender policy, exclusions, services, or monitoring visibility.
6. Use elevated access to dump credentials, establish persistence, move laterally, deploy tooling, or stage ransomware.

How to detect it

Detection should focus on evidence that a low-privileged user or process became elevated and then changed Defender or system security state. Review Windows Security logs for new privileged logons, special privileges assigned, suspicious process creation, service creation, scheduled task registration, and account changes. Review Microsoft Defender Operational logs and endpoint detection telemetry for protection disablement, exclusion additions, tamper-protection events, abnormal Defender platform behavior, or command-line use of Defender tools outside normal administrative workflows. Useful log sources include Windows Security event logs, System event logs, Microsoft-Windows-Windows Defender/Operational, Microsoft-Windows-Sense/Operational, Sysmon, EDR process telemetry, PowerShell logs, scheduled task logs, and service control manager events. Hunt for sequences where a standard user process launches or indirectly causes elevated cmd.exe, powershell.exe, rundll32.exe, reg.exe, sc.exe, schtasks.exe, or wmic.exe activity, followed by Defender policy changes or ransomware staging. Because this is a privilege escalation flaw, exploitation artifacts may be host-local and short-lived; correlate process parent/child chains, token elevation, Defender setting changes, and post-exploitation behavior rather than relying on a single network indicator.

• MsMpEng.exe
• MpCmdRun.exe
• WinDefend
• Microsoft-Windows-Windows Defender/Operational
• Microsoft-Windows-Sense/Operational
• C:\ProgramData\Microsoft\Windows Defender\Platform\
• C:\Program Files\Windows Defender\MpCmdRun.exe
• C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\
• HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
• HKLM\SOFTWARE\Policies\Microsoft\Windows Defender
• Set-MpPreference
• Add-MpPreference
• DisableRealtimeMonitoring
• DisableAntiSpyware
• ExclusionPath
• Event ID 4672
• Event ID 4688
• Event ID 7045
• Event ID 4698

What your security team should do

• Treat this as a high-priority remediation item because it is in CISA KEV, actively exploited in the wild, and associated with ransomware activity.
• Immediately inventory Windows systems running Microsoft Defender antimalware platform and identify any systems not receiving Defender platform updates.
• Push the latest Microsoft Defender platform, engine, and security intelligence updates across endpoints and servers; prioritize privileged access workstations, domain administration systems, servers, and ransomware-sensitive assets.
• Hunt for recent local privilege escalation followed by Defender tampering, suspicious service creation, scheduled task creation, credential access, or ransomware staging activity.
• Review Defender exclusions, disabled protections, tamper protection state, and policy changes for unauthorized modifications.
• Correlate endpoint telemetry with known intrusion activity associated with BlueHammer and ransomware precursors, especially where low-privileged execution is followed by elevated processes.
• Restrict unnecessary local interactive access and local administrator rights to reduce the ability to exploit the flaw.
• Ensure detections exist for Defender service manipulation, suspicious MpCmdRun.exe usage, unauthorized exclusion creation, and unexpected SYSTEM-level child processes.
• For regulated organizations following CISA KEV timelines, track remediation against the 2026-05-06 due date.