CVE-2026-33825

high

Description

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

References

https://www.huntress.com/blog/nightmare-eclipse-intrusion

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825

https://securityaffairs.com/191164/hacking/u-s-cisa-adds-a-flaw-in-microsoft-defender-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2026/04/22/cisa-adds-one-known-exploited-vulnerability-catalog

https://www.darkreading.com/cyberattacks-data-breaches/exploits-turn-windows-defender-attacker-tool

https://www.malwarebytes.com/blog/news/2026/04/april-patch-tuesday-fixes-two-zero-days-including-one-under-active-attack

https://www.infosecurity-magazine.com/news/microsoft-two-zerodays-april-patch/

https://securityaffairs.com/190831/security/microsoft-patch-tuesday-for-april-2026-fixed-actively-exploited-sharepoint-zero-day.html

https://deadeclipse666.blogspot.com/2026/04/public-disclosure-response-for-cve-2026.html

https://www.theregister.com/2026/04/14/microsofts_massive_patch_tuesday/

https://www.securityweek.com/microsoft-patches-exploited-sharepoint-zero-day-and-160-other-vulnerabilities/

https://cyberscoop.com/microsoft-patch-tuesday-april-2026/

https://www.tenable.com/blog/microsofts-april-2026-patch-tuesday-addresses-163-cves-cve-2026-32201

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825

Details

Source: Mitre, NVD

Published: 2026-04-14

Updated: 2026-04-23

Named Vulnerability: BlueHammerKnown Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

Severity: Medium

CVSS v3

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.13762