CVE Watch24 jul 2026

CVE-2026-33825

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

CVSS

7.8

Alto

EPSS

0.4%

p32

KEV

SÍ

22 abr 2026

Exploit Today

0-100

Publicado: 14 abr 2026 · Última mod.: 24 jul 2026 · CWE-1220

EPSS · 30d

0.4%EPSS · 30 días6.7%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

Microsoft / Defender

Vulnerabilidad

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Añadido a KEV

22 abr 2026

Remediar antes de

6 may 2026

Uso conocido en ransomware

Sí

Descripción resumida

Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 ; https://nvd.nist.gov/vuln/detail/CVE-2026-33825

Descripción técnica

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-103509—

—

———P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.5h CVE-2026-78433—

—

——0Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.1d CVE-2026-834997.8 ALT

21.6%

——6Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.2d CVE-2026-819697.8 ALT

21.6%

——6Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileges locally.2d CVE-2026-702187.8 ALT

23.0%

——7Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.2d CVE-2026-702165.5 MED

22.0%

——7Insufficient granularity of access control in Windows Mobile Device Management allows an authorized attacker to perform tampering locally.2d