CVE-2026-33825
Published: 14 April 2026
Description
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Mitigating Controls (NIST 800-53 r5)AI
AC-6 enforces the principle of least privilege, directly preventing local privilege escalation enabled by insufficient access control granularity in Microsoft Defender.
AC-3 requires systems to enforce approved access authorizations with sufficient granularity to block unauthorized operations and privilege elevation in Microsoft Defender.
AC-25 implements a tamper-proof reference monitor to enforce granular access control policies, addressing the core insufficient granularity flaw in Microsoft Defender.
Security SummaryAI
CVE-2026-33825 is an insufficient granularity of access control vulnerability in Microsoft Defender that enables local privilege escalation. Published on 2026-04-14, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-1220. The flaw affects Microsoft Defender, where access controls lack the necessary precision to prevent unauthorized operations.
A low-privileged local attacker can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation grants high-impact confidentiality, integrity, and availability consequences, allowing the attacker to elevate privileges on the affected system.
Microsoft's Security Response Center provides an update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 detailing patches and mitigations. The vulnerability appears in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825, indicating active exploitation. Additional analysis is available in Huntress's blog post at https://www.huntress.com/blog/nightmare-eclipse-intrusion.
Details
- CWE(s)
- KEV Date Added
- See CISA KEV catalog
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-33825 is an access control vulnerability in Microsoft Defender enabling local privilege escalation from low privileges, directly facilitating T1068: Exploitation for Privilege Escalation.