2835 matches found
Don’t Wait for a Patch. Mitigate RedSun Zero-Day Risk in Microsoft Defender Today
Key Takeaways RedSun is a critical zero-day vulnerability in Microsoft Defender that allows low-privileged users to gain SYSTEM access No patch is currently available, leaving all Defender-enabled Windows systems potentially exposed Qualys VMDR detects affected assets instantly QID 92382 TruRisk...
Exploit for Insufficient Granularity of Access Control in Microsoft
🔨 CVE-2026-33825: BlueHammer Microsoft Defender Elevation o...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-33825link is external Microsoft Defender Insufficient Granularity of Access Control Vulnerability This type of vulnerability is a frequent attack vector for...
Microsoft Defender Insufficient Granularity of Access Control Vulnerability
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally...
Detection strategies across cloud and identities against infiltrating IT workers
In this article 1. Attack chain overview 1. Activities in pre-recruitment phase 2. Activities in recruiting phase 3. Activities in post-recruitment phase 2. Mitigation and protection guidance 3. Microsoft Defender XDR detections The shift to remote and hybrid work since the pandemic expanded glob...
Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched
Huntress is warning that threat actors are exploiting three recently disclosed security flaws in Microsoft Defender to gain elevated privileges in compromised systems. The activity involves the exploitation of three vulnerabilities that are codenamed BlueHammer requires GitHub sign-in, RedSun, an...
April Microsoft Patch Tuesday
April Microsoft Patch Tuesday. A total of 167 vulnerabilities, about twice as many as in March. There is one vulnerability already being exploited in the wild: 🔻 Spoofing - Microsoft SharePoint Server CVE-2026-32201. ZDI experts say "Spoofing bugs in SharePoint often manifest as cross-site...
ThreatsDay Bulletin: Defender 0-Day, SonicWall Brute-Force, 17-Year-Old Excel RCE and 15 More Stories
You know that feeling when you open your feed on a Thursday morning and it's just... a lot? Yeah. This week delivered. We've got hackers getting creative in ways that are almost impressive if you ignore the whole "crime" part, ancient vulnerabilities somehow still ruining people's days, and enoug...
Security Updates for Windows Defender (April 2026)
The Antimalware Platform version of Microsoft Windows Defender installed on the remote Windows host is prior to 4.18.26030.3011. It is, therefore, affected by a privilege escalation vulnerability: - Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to...
VulnCheck KEV: CVE-2026-33825
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally...
CVE-2026-33825
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally...
April Patch Tuesday fixes two zero-days, including one under active attack
This month’s patch Tuesday looks to remediate 167 security vulnerabilities including two zero-day vulnerabilities, one of which is known to be actively exploited in the wild. This makes April one of those months where “Patch Tuesday” looks more like “patch the entire stack,” from servers and...
Microsoft Defender’s inability to address vulnerabilities
Microsoft has identified a vulnerability in System Center. A malicious individual could exploit this vulnerability by allowing Windows Defender to apply insufficient access control, thereby enabling an authorized attacker to escalate their privileges locally. UPDATE If Microsoft Defender...
The vulnerability of Windows Defender’s antivirus protection allows attackers to increase their privileges.
The vulnerability of Windows Defender’s antivirus protection for Windows operating systems is related to deficiencies in the access control mechanism. Exploiting this vulnerability can allow attackers to enhance their privileges...
Patch Tuesday, April 2026 Edition
Microsoft today pushed software updates to fix a staggering 167 security vulnerabilities in its Windows operating systems and related software, including a SharePoint Server zero-day and a publicly disclosed weakness in Windows Defender dubbed "BlueHammer." Separately, Google Chrome fixed its...
EUVD-2026-22643
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally...
CVE-2026-33825
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally...
CVE-2026-33825 Microsoft Defender Elevation of Privilege Vulnerability
...
CVE-2026-33825 Microsoft Defender Elevation of Privilege Vulnerability
...
CVE-2026-33825
CVE-2026-33825 is a local EoP vulnerability in the Microsoft Defender Antimalware Platform. A TOCTOU race condition during malware remediation (in Defender’s threat remediation engine) lets an authenticated, low-privilege user pause remediation via NTFS oplocks and redirect Defender operations th...