CVE-2026-33825
Microsoft Defender Insufficient Granularity of Access Control Vulnerability - [Actively Exploited]
Description
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
INFO
Published Date :
April 14, 2026, 6:17 p.m.
Last Modified :
April 23, 2026, 5:26 p.m.
Remotely Exploit :
No
Source :
[email protected]
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Unknown
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 ; https://nvd.nist.gov/vuln/detail/CVE-2026-33825
Affected Products
The following products are affected by CVE-2026-33825
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | f38d906d-7342-40ea-92c1-6c4a2c6478c8 | ||||
| CVSS 3.1 | HIGH | [email protected] |
Public PoC/Exploit Available at Github
CVE-2026-33825 has a 18 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-33825.
| URL | Resource |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825 | US Government Resource |
| https://www.huntress.com/blog/nightmare-eclipse-intrusion | Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-33825 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-33825
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
RedSun PoC for self use
CMake C++
None
None
C++ Python C
Detection methods, KQL hunt queries, and defensive recommendations for the RedSun and UnDefend Microsoft Defender zero-day vulnerabilities (April 2026)
Threat hunting query for bluehammer CVE windows CVE-2026-33825
None
C3PO unified intelligence repository — threats, infrastructure, archives, and R&D
Python
Microsoft Defender XDR KQL detections for RedSun, BlueHammer, UnDefend, and CVE-2026-33825-related Defender abuse behaviors.
advanced-hunting defender-xdr detection-engineering kql-threathunting microsoft-defender microsoft-defender-xdr privilege-escalation redsun threat-detection-windows windows-security bluehammer cve-2026-33825 undefend
Community defense plan for the post-Mythos cybersecurity landscape. 49 files, 8000+ lines. 13 stack guides, 19 scanning prompts, 5 audit scripts, Docker scanner. Free. Open. CC BY 4.0.
Dockerfile Shell PowerShell
None
Security Tracker
Python
Small side project of building a home lab from scratch
Python
Threat Hunting based on KQL
None
personal
Groovy CMake C C++ Makefile Python Assembly Linker Script Shell Go
None
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-33825 vulnerability anywhere in the article.
-
Daily CyberSecurity
Critical 9.8 CVSS Flaws Hit ArcGIS Infrastructure
Esri has issued an urgent security bulletin regarding two critical vulnerabilities affecting developer credentials within ArcGIS Online, ArcGIS Location Platform, and ArcGIS Enterprise. The flaws, whi ... Read more
-
Daily CyberSecurity
In the Wild: Information Disclosure (CVE-2026-20133) Exploited in Cisco SD-WAN Manager
The networking giant Cisco has issued an urgent warning to enterprise administrators. In April 2026, the Cisco Product Security Incident Response Team (PSIRT) confirmed they are aware of active exploi ... Read more
-
Daily CyberSecurity
Linux Privilege Escalation: “Pack2TheRoot” Flaw Impacts Major Distributions
A long-standing security flaw has been unearthed in a core component of the modern Linux desktop and server ecosystem. Known as Pack2TheRoot, this critical vulnerability resides in PackageKit, a D-Bus ... Read more
-
Daily CyberSecurity
Over 400,000 WordPress Sites at Risk as “Breeze” Plugin Zero-Day Is Exploited in the Wild
A major security threat is currently sweeping through the WordPress ecosystem. Breeze, a highly popular caching plugin developed by the Cloudways team and active on over 400,000 websites, is under act ... Read more
-
Daily CyberSecurity
CVE-2026-33626: High-Severity SSRF Exploited in the Wild to Hijack AI Inference Engines
On April 21, 2026, a high-severity Server-Side Request Forgery (SSRF) vulnerability was disclosed in LMDeploy, a popular toolkit for serving vision-language and large language models (LLMs). Within a ... Read more
-
Daily CyberSecurity
Microsoft Defender Zero-Day “BlueHammer” Hits KEV Catalog Following Researcher’s Protest
Image: Will Dormann CISA has officially added a fresh vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation in the wild. The flaw, tracked as CVE-2 ... Read more
-
Daily CyberSecurity
GitLab Security Update: High-Severity Vulnerabilities Patched in April Release
GitLab has released a vital set of security updates for both Community Edition (CE) and Enterprise Edition (EE) to address a range of vulnerabilities, including high-severity flaws that could allow un ... Read more
-
Daily CyberSecurity
CVE-2026-40342: CVSS 10.0 Path Traversal to RCE in Firebird Database
Researchers have disclosed a critical-severity vulnerability in Firebird, the long-standing relational database with roots dating back to 1981, that allows attackers to execute arbitrary code with the ... Read more
-
Daily CyberSecurity
Command Injection Vulnerability (CVE-2025-29635) Exploited in the Wild
The Akamai Security Intelligence and Response Team (SIRT) has issued a warning regarding a surge in malicious activity targeting end-of-life networking hardware. According to a new report, threat acto ... Read more
-
CybersecurityNews
Hackers Use Nightmare-Eclipse Tools After Compromising FortiGate SSL VPN Access
A real-world intrusion campaign leveraging publicly available Nightmare-Eclipse privilege escalation tooling, BlueHammer, RedSun, and UnDefend, following what appears to be unauthorized access through ... Read more
-
Huntress
Nightmare-Eclipse Tooling Seen in Real-World Intrusion
Acknowledgments: Special thanks to Dani Lopez, Tanner Filip, Anton Ovrutsky, Lindsey O’Donnell-Welch, and John Hammond for their contributions to this investigation and write-up. This article was also ... Read more
-
TheCyberThrone
Microsoft Defender Under Siege
OverviewThree zero-day exploits targeting Microsoft Defender — BlueHammer, RedSun, and UnDefend — have been confirmed exploited in the wild by threat actors. All three were publicly released on GitHub ... Read more
-
The Hacker News
Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched
Huntress is warning that threat actors are exploiting three recently disclosed security flaws in Microsoft Defender to gain elevated privileges in compromised systems. The activity involves the exploi ... Read more
-
CybersecurityNews
Leaked Windows Defender 0-Day Vulnerability Actively Exploited in Attacks
An active in-the-wild exploitation of three recently leaked Windows Defender privilege escalation vulnerabilities, with threat actors deploying proof-of-concept exploit code sourced directly from publ ... Read more
-
Help Net Security
Researcher drops two more Microsoft Defender zero-days, all three now exploited in the wild
The security researcher who earlier this month published a proof-of-concept (PoC) exploit for a zero-day privilege escalation vulnerability in Microsoft Defender is back with two more. The first, dubb ... Read more
-
CybersecurityNews
Microsoft Defender 0-Day Vulnerability “RedSun” Enables Full SYSTEM Access
A newly disclosed zero-day vulnerability in Microsoft Defender, dubbed “RedSun,” allows an unprivileged user to escalate privileges to full SYSTEM-level access on fully patched Windows 10, Windows 11, ... Read more
-
The Hacker News
ThreatsDay Bulletin: Defender 0-Day, SonicWall Brute-Force, 17-Year-Old Excel RCE and 15 More Stories
You know that feeling when you open your feed on a Thursday morning and it's just... a lot? Yeah. This week delivered. We've got hackers getting creative in ways that are almost impressive if you igno ... Read more
-
Daily CyberSecurity
RedSun: New Windows Defender Zero-Day Turns Protector into Attacker, PoC Publishes
Just as the cybersecurity community began digesting the latest round of patches for the high-profile “BlueHammer” vulnerability, a new storm has appeared on the horizon. On April 16, 2026, the securit ... Read more
-
security.nl
Microsoft dicht actief aangevallen spoofinglek in SharePoint Server
Tijdens de patchdinsdag van april heeft Microsoft een actief aangevallen spoofinglek in SharePoint Server gedicht. De kwetsbaarheid (CVE-2026-32201) maakt het mogelijk voor een ongeauthenticeerde aanv ... Read more
-
CrowdStrike.com
April 2026 Patch Tuesday: Two Zero-Days and Eight Critical Vulnerabilities Among 164 CVEs
Microsoft has addressed 164 vulnerabilities in its April 2026 security update release, double the number of vulnerabilities in March 2026. These include one exploited zero-day vulnerability, one previ ... Read more
The following table lists the changes that have been made to the
CVE-2026-33825 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Modified Analysis by [email protected]
Apr. 23, 2026
Action Type Old Value New Value Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825 Types: US Government Resource Added Reference Type CISA-ADP: https://www.huntress.com/blog/nightmare-eclipse-intrusion Types: Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Apr. 22, 2026
Action Type Old Value New Value Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Apr. 22, 2026
Action Type Old Value New Value Added Reference https://www.huntress.com/blog/nightmare-eclipse-intrusion -
Initial Analysis by [email protected]
Apr. 20, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:microsoft:defender_antimalware_platform:*:*:*:*:*:*:*:* versions up to (excluding) 4.18.26030.3011 Added Reference Type Microsoft Corporation: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 Types: Vendor Advisory -
New CVE Received by [email protected]
Apr. 14, 2026
Action Type Old Value New Value Added Description Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally. Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-1220 Added Reference https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825