Veille CVE
CVE-2026-33825
7.8 Élevée Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Microsoft Defender Insufficient Granularity of Access Control Vulnerability
Ajoutée le 22/04/2026 · Échéance de correction (agences US) : 06/05/2026
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.8 Élevée | secure@microsoft.com | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825 US Government Resource
- https://www.huntress.com/blog/nightmare-eclipse-intrusion Third Party Advisory