CVE-2026-33825 is an insufficient granularity of access control vulnerability in Microsoft Defender. CISA added it to the Known Exploited Vulnerabilities catalogue on 22 April 2026, which means attackers have used it in real attacks. Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
What this CVE means in practice
An insufficient granularity of access control flaw means the product’s authorisation boundaries are too coarse, so a user or process that should have limited rights can reach functions or data that were not meant to be exposed. In Microsoft Defender, that weakness can turn an already authenticated attacker into a local privilege escalation path.
That matters because Defender sits close to endpoint security decisions, policy enforcement and telemetry. When access control is too broad, the issue is not just “too much access” in the abstract, it is a route to higher privilege on a system that defenders often trust to be resilient and difficult to tamper with.
Why this kind of access control weakness is dangerous
Access control granularity determines whether permissions are separated by task, scope and trust boundary. If controls are overly coarse, an attacker may be able to cross from a low-privilege context into administrative functions, protected configuration, or security-sensitive operations that should have remained isolated.
For endpoint security software, that can have outsized impact. A flaw in a protection product can weaken the host itself, reduce visibility, or make later defensive response harder because the product that should detect or constrain abuse becomes part of the attack path.
How organisations assess exposure and reduce blast radius
Exposure review should start with asset inventory and product identification, then confirm which endpoints run the affected Microsoft Defender component and whether those systems are reachable by potentially malicious local users or untrusted code. Organisations should rely on the vendor advisory and the CISA KEV catalogue for authoritative version and patch details rather than recreating them from secondary reports. For broader vulnerability prioritisation, the Vulnerability Management Guide is a useful companion because it ties KEV status to remediation sequencing and exception handling.
Where immediate patching is not possible, compensating controls should focus on reducing local attack opportunity and limiting what an attacker can do after initial code execution. In practice that means tightening local admin access, hardening endpoint configuration, and watching for changes to security tooling state. The Windows Endpoint Hardening Guide is relevant here because exploit resistance and tamper-aware configuration become more important when a security product itself is in scope.
Detection and post-exploitation review
After patching, organisations should review for signs that the flaw was used before remediation. That review should include unusual local privilege changes, Defender configuration tampering, suspicious service or policy changes, and execution that appears to have occurred from a lower-trust account before elevation. If compromise is suspected, the safest assumption is that the attacker may have used the privilege gained to disable controls, harvest data, or stage additional payloads.
For incident hunting and adversary technique mapping, MITRE ATT&CK Enterprise Matrix helps connect privilege escalation and endpoint defence abuse to observable behaviours, while CVE Program and NIST National Vulnerability Database are the authoritative references for the vulnerability record itself.
Risk and Threat Considerations
This vulnerability is attractive because local privilege escalation can be enough to shift from a foothold to meaningful control on the endpoint. If Microsoft Defender’s access boundaries are too coarse, an attacker who already has execution on the machine may be able to cross into more powerful actions without needing a separate exploit chain.
Failure mechanism: Coarse authorisation lets an attacker reuse a lower-privilege context to invoke Defender functionality or related protected operations that should have remained separated.
Impact: The attacker may gain higher local privilege, weaken endpoint defences, or create a better platform for persistence, credential access, and lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Local privilege escalation is reduced by controlling who can hold and use privileged access. |
| Recommendation — Restrict privileged access paths and remove unnecessary local admin rights on affected endpoints. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | This CVE exploits excessive effective access and weak separation of duties. |
| SI-2 — Flaw Remediation | A KEV-listed vulnerability requires disciplined remediation and verification. | |
| Recommendation — Apply least privilege to limit which users can reach Defender administration functions. Prioritise remediation for the vulnerable Defender component and verify patch completion. | ||
| ISO/IEC 27001:2022 | A.8.2 — Privileged access rights | The flaw can elevate a local user into a privileged state that must be controlled. |
| Recommendation — Review and tighten privileged access rights for systems running Microsoft Defender. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | The vulnerability enables local privilege escalation after initial access. |
| Recommendation — Map telemetry for privilege-escalation behaviour and investigate host manipulation after exploitation. | ||
Practitioner Guidance
Why practitioners should care: Treat this as both a patching issue and an integrity issue for the endpoint security stack. A flaw in a defensive control can have second-order impact beyond the immediate host, especially if the product is relied on for isolation, detection, or policy enforcement.
What to watch for: Give priority to endpoints where local users, developer tooling, script execution, or loosely controlled admin access increase the chance that a low-privilege actor can reach the vulnerable path before patching is completed.
Practitioner takeaway: Remediation should pair software update work with a quick review of local privilege, Defender configuration integrity, and any indicators that the endpoint was already manipulated.
Related resources from NHI Mgmt Group
- Why do manual access reviews often fail to keep Microsoft 365 permissions under control?
- What are the signs that Microsoft 365 public file access is getting out of control?
- What breaks when access control is misconfigured in Microsoft 365 sharing environments?
- When does AWS-native authorization become insufficient for enterprise access control decisions?