In CISA KEV7.8 HighCWE-1220Ransomware use
CVE-2026-33825
Microsoft Defender Insufficient Granularity of Access Control Vulnerability
MicrosoftDefender
Status
- Exploited in the wild
- In CISA KEV since 22 Apr
- Vendor fix available
- Known ransomware use
Federal deadlineWed 6 May, 23:59 UTC
Passed 171 days ago
CISA KEV · added 22 Apr
Exploit probabilityEPSSchecked 22 Oct
0.4%probability of exploitation in the next 30 days
Higher than 33% of scored CVEs
SeverityCVSS
7.8High
Description NVD
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 17 articles · 8 outlets
See the full timelineShow as table
- CISA warns BlueHammer flaw now used in ransomware attacksSecurity Affairs
- BlueHammer Defender Flaw Linked to Ransomware ExploitsSecurityWeek
- Windows Zero-Day Barrage Continues After Patch TuesdayDark Reading · mentions it in passing
- Windows Zero Days YellowKey & GreenPlasma Expose BitLocker BypassSecurity Affairs
- CISA urges patch Microsoft Defender flaw CVE-2026-33825 by May 6Security Affairs
- Recent Microsoft Defender Vulnerability Exploited as Zero-DaySecurityWeek
- CISA adds Microsoft Defender flaw CVE-2026-33825 to KEV listCISA · official notice
- CISA adds Microsoft Defender flaw CVE-2026-33825 to KEV listCISA · official notice
- Exploits Turn Windows Defender into Attacker ToolDark Reading
- Microsoft Defender under attack as three zero-days, two of them still unpatched, enable elevated accessSecurity Affairs
- April Patch Tuesday patches two Microsoft zero day flawsMalwarebytes · mentions it in passing
- Microsoft Fixes Two Zero-Days in April Patch TuesdayInfosecurity · mentions it in passing
- Microsoft fixes SharePoint zero day CVE-2026-32201 in AprilSecurity Affairs · mentions it in passing
- Microsoft patches 167 flaws, including exploited SharePoint bugRapid7 · mentions it in passing
- Privilege Elevation Dominates Massive Microsoft Patch UpdateDark Reading · mentions it in passing
- Microsoft patches SharePoint zero day CVE-2026-32201 in the wildSecurityWeek · mentions it in passing
- Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)SANS ISC · first in our coverage · mentions it in passing