THREATOPS

THREAT OPS › CVEs › CVE-2026-33825

CVE-2026-33825 — Microsoft Defender Insufficient Granularity of Access Control Vulnerability

CISA KEVExploited: confirmedMicrosoft

Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.

Vulnerability details

Affected productsDefender
KEV remediation due2026-05-06

Exploiting threat actors

Earth LuscaG1006

Related reporting

IT threat evolution in Q2 2026. Non-mobile statisticssecurelist
The April 2026 Security Update Reviewzdi_blog
June 2026 CVE Landscaperecordedfuture
April 2026 CVE Landscaperecordedfuture