[KEV] CVE-2026-33825 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-33825 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-33825 is a local privilege escalation vulnerability in Microsoft Defender, caused by insufficient granularity of access control within the product.

Technical Detail

The flaw stems from improperly scoped access controls within Microsoft Defender, which fail to adequately restrict what an authenticated local user can access or modify. An authorized attacker with local access can exploit this weakness to elevate their privileges beyond what their account should permit. The result is privilege escalation, potentially enabling the attacker to execute code or access resources at a higher integrity level than intended.

Exploitation Status

CISA has confirmed active exploitation in the wild, adding this CVE to the Known Exploited Vulnerabilities catalog on April 22, 2026. The exploit is rated as operationally mature, meaning a functional exploit exists and is being used in real-world attacks, not merely demonstrated in a controlled research setting. Organizations should treat this as an actively weaponized vulnerability requiring immediate attention.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. No campaigns, targeted sectors, or named adversary groups have been publicly associated with exploitation of this vulnerability as of April 24, 2026.

What To Do

Apply the relevant Microsoft Defender security update immediately. Per CISA's Known Exploited Vulnerabilities catalog, federal agencies operating under BOD 22-01 are required to remediate this vulnerability by the deadline associated with the April 22, 2026 KEV listing. All organizations should prioritize patching given confirmed active exploitation. Monitor endpoint detection logs for anomalous privilege changes or unexpected Defender process behavior as potential indicators of exploitation attempts. If patching cannot be applied immediately, restrict local interactive access to affected systems and audit local account permissions as a temporary risk reduction measure.