Microsoft Defender CVE-2026-33825 Local Privilege Escalation

CISA added CVE-2026-33825 to the Known Exploited Vulnerabilities catalog. The vulnerability is an insufficient granularity of access control in Microsoft Defender that allows a local authorized attacker to elevate privileges to SYSTEM level. Affected versions are 4.0.0.0 before 4.18.26030.3011. The CVSS 3.1 base score is 7.8 (HIGH) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C. Exploitation status is listed as active, not automatable, with total technical impact.

Federal civilian agencies subject to BOD 22-01 must remediate this vulnerability under the KEV remediation requirements. All organizations using Microsoft Defender should verify their deployment version and apply the Microsoft patch via the vendor advisory on msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825. IT security teams should prioritize patching endpoints given the active exploitation status and local privilege escalation risk.