CVE-2026-33825
Microsoft Defender Insufficient Granularity of Access Control Vulnerability - [Actively Exploited]
Description
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
INFO
Published Date :
April 14, 2026, 6:17 p.m.
Last Modified :
April 23, 2026, 5:26 p.m.
Remotely Exploit :
No
Source :
[email protected]
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Unknown
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 ; https://nvd.nist.gov/vuln/detail/CVE-2026-33825
Affected Products
The following products are affected by CVE-2026-33825
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | f38d906d-7342-40ea-92c1-6c4a2c6478c8 | ||||
| CVSS 3.1 | HIGH | [email protected] |
Public PoC/Exploit Available at Github
CVE-2026-33825 has a 21 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-33825.
| URL | Resource |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825 | US Government Resource |
| https://www.huntress.com/blog/nightmare-eclipse-intrusion | Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-33825 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-33825
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
C
None
CVE-2026-41091
C++
State-aware Active Directory attack orchestration
Makefile Go Shell
KQL Queries
CVE-2026-33825
C C++
RedSun PoC for self use
CMake C++
None
C++ Python C
Detection methods, KQL hunt queries, and defensive recommendations for the RedSun and UnDefend Microsoft Defender zero-day vulnerabilities (April 2026)
Threat hunting query for bluehammer CVE windows CVE-2026-33825
None
C3PO unified intelligence repository — threats, infrastructure, archives, and R&D
Python
Microsoft Defender XDR KQL detections for RedSun, BlueHammer, UnDefend, and CVE-2026-33825-related Defender abuse behaviors.
advanced-hunting defender-xdr detection-engineering kql-threathunting microsoft-defender microsoft-defender-xdr privilege-escalation redsun threat-detection-windows windows-security bluehammer cve-2026-33825 undefend
Community defense plan for the post-Mythos cybersecurity landscape. 49 files, 8000+ lines. 13 stack guides, 19 scanning prompts, 5 audit scripts, Docker scanner. Free. Open. CC BY 4.0.
Dockerfile Shell PowerShell
None
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-33825 vulnerability anywhere in the article.
-
TheCyberThrone
Microsoft Patch Tuesday — June 2026
Microsoft’s June 2026 Patch Tuesday is the largest release since the Patch Tuesday program began, surpassing the previous record of 167 CVEs set in October 2025. This month’s release addresses 206 vul ... Read more
-
The Hacker News
Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows
The anonymous security researcher going by the name Chaotic Eclipse (aka Nightmare-Eclipse) has released a proof-of-concept (PoC) exploit for yet another Microsoft Defender zero-day named RoguePlanet. ... Read more
-
europa.eu
Cyber Brief 26-06 - May 2026
Cyber Brief (May 2026)June 2, 2026 - Version: 1TLP:CLEARExecutive summaryWe analysed 325 open source reports for this Cyber Brief1.Relating to cyber policy and law enforcement, Europol supported inter ... Read more
-
CybersecurityNews
Microsoft MSRC Allegedly Dismissed Dependency Confusion Vulnerability, Claims Researcher
A dependency confusion vulnerability affecting Microsoft’s Azure Portal after the Microsoft Security Response Center (MSRC) closed the case, claiming the confirmed remote code execution evidence did n ... Read more
-
CybersecurityNews
Microsoft Clarifies It Won’t Sue Security Researchers Amid Nightmare-Eclipse Controversy
Microsoft has clarified its stance, reducing perceived legal threats and reaffirming its commitment to coordinated vulnerability disclosure, following significant backlash from the security research c ... Read more
-
The Hacker News
Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal
Microsoft has come out strongly in favor of Coordinated Vulnerability Disclosure (CVD), urging the research community to share their findings and give affected vendors an opportunity to better underst ... Read more
-
CybersecurityNews
Microsoft Warns Public Release of Zero-Day Details Before Vendor Coordination
Microsoft has issued a strong warning after multiple zero-day vulnerabilities were publicly disclosed without prior coordination, raising concerns about increased risk to users and enterprise environm ... Read more
-
CybersecurityNews
GitLab Suspends Windows Exploit Researcher Nightmare-Eclipse After GitHub Ban
The anonymous researcher known as Nightmare-Eclipse has been blocked from two major code-hosting platforms in less than a week, as their disruptive public zero-day campaign against Microsoft draws ser ... Read more
-
The Cyber Express
Microsoft Patches Actively Exploited Defender Vulnerabilities Affecting Enterprise Systems
Microsoft has confirmed active exploitation of two security vulnerabilities in its security ecosystem, identified as CVE-2026-41091 and CVE-2026-45498, both evaluated under the CVSS scoring system. Th ... Read more
-
TheCyberThrone
Windows Zero-Days Trilogy: Chaotic Eclipse’s Unpatched Assault
Background: Who Is Chaotic Eclipse?Security researcher Chaotic Eclipse, operating under the GitHub handle Nightmare-Eclipse, has published working exploit code for five separate Windows vulnerabilitie ... Read more
-
The Hacker News
Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation
An anonymous cybersecurity researcher who disclosed three Microsoft Defender vulnerabilities has returned with two more zero-days involving a BitLocker bypass and a privilege escalation impacting Wind ... Read more
-
Daily CyberSecurity
Critical 9.8 CVSS Flaws Hit ArcGIS Infrastructure
Esri has issued an urgent security bulletin regarding two critical vulnerabilities affecting developer credentials within ArcGIS Online, ArcGIS Location Platform, and ArcGIS Enterprise. The flaws, whi ... Read more
-
Daily CyberSecurity
In the Wild: Information Disclosure (CVE-2026-20133) Exploited in Cisco SD-WAN Manager
The networking giant Cisco has issued an urgent warning to enterprise administrators. In April 2026, the Cisco Product Security Incident Response Team (PSIRT) confirmed they are aware of active exploi ... Read more
-
Daily CyberSecurity
Linux Privilege Escalation: “Pack2TheRoot” Flaw Impacts Major Distributions
A long-standing security flaw has been unearthed in a core component of the modern Linux desktop and server ecosystem. Known as Pack2TheRoot, this critical vulnerability resides in PackageKit, a D-Bus ... Read more
-
Daily CyberSecurity
Over 400,000 WordPress Sites at Risk as “Breeze” Plugin Zero-Day Is Exploited in the Wild
A major security threat is currently sweeping through the WordPress ecosystem. Breeze, a highly popular caching plugin developed by the Cloudways team and active on over 400,000 websites, is under act ... Read more
-
Daily CyberSecurity
CVE-2026-33626: High-Severity SSRF Exploited in the Wild to Hijack AI Inference Engines
On April 21, 2026, a high-severity Server-Side Request Forgery (SSRF) vulnerability was disclosed in LMDeploy, a popular toolkit for serving vision-language and large language models (LLMs). Within a ... Read more
-
Daily CyberSecurity
Microsoft Defender Zero-Day “BlueHammer” Hits KEV Catalog Following Researcher’s Protest
Image: Will Dormann CISA has officially added a fresh vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation in the wild. The flaw, tracked as CVE-2 ... Read more
-
Daily CyberSecurity
GitLab Security Update: High-Severity Vulnerabilities Patched in April Release
GitLab has released a vital set of security updates for both Community Edition (CE) and Enterprise Edition (EE) to address a range of vulnerabilities, including high-severity flaws that could allow un ... Read more
-
Daily CyberSecurity
CVE-2026-40342: CVSS 10.0 Path Traversal to RCE in Firebird Database
Researchers have disclosed a critical-severity vulnerability in Firebird, the long-standing relational database with roots dating back to 1981, that allows attackers to execute arbitrary code with the ... Read more
-
Daily CyberSecurity
Command Injection Vulnerability (CVE-2025-29635) Exploited in the Wild
The Akamai Security Intelligence and Response Team (SIRT) has issued a warning regarding a surge in malicious activity targeting end-of-life networking hardware. According to a new report, threat acto ... Read more
The following table lists the changes that have been made to the
CVE-2026-33825 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Modified Analysis by [email protected]
Apr. 23, 2026
Action Type Old Value New Value Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825 Types: US Government Resource Added Reference Type CISA-ADP: https://www.huntress.com/blog/nightmare-eclipse-intrusion Types: Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Apr. 22, 2026
Action Type Old Value New Value Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Apr. 22, 2026
Action Type Old Value New Value Added Reference https://www.huntress.com/blog/nightmare-eclipse-intrusion -
Initial Analysis by [email protected]
Apr. 20, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:microsoft:defender_antimalware_platform:*:*:*:*:*:*:*:* versions up to (excluding) 4.18.26030.3011 Added Reference Type Microsoft Corporation: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 Types: Vendor Advisory -
New CVE Received by [email protected]
Apr. 14, 2026
Action Type Old Value New Value Added Description Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally. Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-1220 Added Reference https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825