PT-2025-21360 · Microsoft · Defender For Endpoint

Name of the Vulnerable Software and Affected Versions: Microsoft Defender for Endpoint affected versions not specified Description: The issue concerns an elevation of privilege in Microsoft Defender for Endpoint. No specific details about the technical aspects of the issue, such as API endpoints,...

The vulnerability of Microsoft Defender for Endpoint on Linux operating systems, related to improper external management of file names or paths, allows attackers to escalate their privileges.

The vulnerability of Microsoft Defender for Endpoint on Linux operating systems is related to incorrect external management of file names or file paths. Exploiting this vulnerability can allow attackers to increase their privileges...

CVE-2025-26685

Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network...

CVE-2025-26684

External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally...

CVE-2025-26685 Microsoft Defender for Identity Spoofing Vulnerability

...

CVE-2025-26685 Microsoft Defender for Identity Spoofing Vulnerability

...

CVE-2025-26685

CVE-2025-26685 – Microsoft Defender for Identity Spoofing : Affected component is Microsoft Defender for Identity. Root cause is improper authentication that allows an unauthenticated attacker on the same LAN/adjacent network to spoof against the target. Direct impact includes impersonation and, ...

CVE-2025-26684 Microsoft Defender Elevation of Privilege Vulnerability

...

CVE-2025-26684

CVE-2025-26684 is a Microsoft Defender Elevation of Privilege vulnerability in Defender for Endpoint where external control of a file name or path enables a locally authenticated attacker with high privileges to elevate to a higher privilege level. The CVSSv3.1 base score is 6.7 (Medium) with loc...

CVE-2025-26684 Microsoft Defender Elevation of Privilege Vulnerability

...

Microsoft Defender for Identity Spoofing Vulnerability

Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network...

Microsoft Defender Elevation of Privilege Vulnerability

External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally...

PT-2025-20939 · Microsoft · Defender For Endpoint

Name of the Vulnerable Software and Affected Versions: Microsoft Defender for Endpoint affected versions not specified Description: The issue allows an authorized attacker to elevate privileges locally through external control of file name or path. The vulnerability exists in the grab java versio...

Microsoft Defender 授权问题漏洞

Microsoft Defender is a threat protection software from Microsoft Corporation USA. An authorization issue vulnerability exists in Microsoft Defender. An attacker exploits this vulnerability to perform spoofing attacks...

Microsoft Defender 安全漏洞

Microsoft Defender is a threat protection software from Microsoft USA. A security vulnerability exists in Microsoft Defender. An attacker exploiting the vulnerability can elevate privileges...

PT-2025-20940 · Microsoft · Defender For Identity

Name of the Vulnerable Software and Affected Versions: Microsoft Defender for Identity affected versions not specified Description: The issue is related to improper authentication in Microsoft Defender for Identity, allowing an unauthorized attacker to perform spoofing over an adjacent network...

KLA83569 Multiple vulnerabilities in Microsoft System Center

Multiple vulnerabilities were found in Microsoft System Center. Malicious users can exploit these vulnerabilities to perform cross-site scripting attack, spoof user interface, gain privileges. Below is a complete list of vulnerabilities: 1. A spoofing vulnerability in Microsoft Defender for...

Analyzing CVE-2025-31191: A macOS security-scoped bookmarks-based sandbox escape

In April 2024, Microsoft uncovered a vulnerability in macOS that could allow specially crafted codes to escape the App Sandbox and run unrestricted on the system. An attacker could create an exploit to escape the App Sandbox without user interaction required for any sandboxed app using...

Node.js Malware Campaign Targets Crypto Users with Fake Binance and TradingView Installers

Microsoft is calling attention to an ongoing malvertising campaign that makes use of Node.js to deliver malicious payloads capable of information theft and data exfiltration. The activity, first detected in October 2024, uses lures related to cryptocurrency trading to trick users into installing ...

How cyberattackers exploit domain controllers using ransomware

In recent years, human-operated cyberattacks have undergone a dramatic transformation. These attacks, once characterized by sporadic and opportunistic attacks, have evolved into highly sophisticated, targeted campaigns aimed at causing maximum damage to organizations, with the average cost of a...