Microsoft has released a security update for Microsoft Defender to address a privilege escalation for which public proof-of-concept code is available, making exploitation more likely[1]. Given that Microsoft Defender is installed on virtually all Windows systems, immediate action is required to verify that your systems are protected.
Description
On April 14, 2026, Microsoft published CVE-2026-33825, an elevation of privilege vulnerability in the Microsoft Defender Antimalware Platform[1]. The vulnerability allows an attacker with local access to a system to elevate their privileges to a higher level. The vulnerability exists because Windows Defender does not properly enforce access controls, allowing an authenticated attacker to gain elevated rights on the system. Proof-of-Concept exploit code has been publicly released, demonstrating how to abuse this vulnerability. This significantly increases the likelihood that attackers will use this vulnerability in real-world attacks.Microsoft Defender Antimalware Platform versions before or at version 4.18.26020.6 are affected by this vulnerability. Versions after version 4.18.26030.3011 are not affected by this vulnerability.
Description
On April 14, 2026, Microsoft published CVE-2026-33825, an elevation of privilege vulnerability in the Microsoft Defender Antimalware Platform[1]. The vulnerability allows an attacker with local access to a system to elevate their privileges to a higher level. The vulnerability exists because Windows Defender does not properly enforce access controls, allowing an authenticated attacker to gain elevated rights on the system. Proof-of-Concept exploit code has been publicly released, demonstrating how to abuse this vulnerability. This significantly increases the likelihood that attackers will use this vulnerability in real-world attacks.Microsoft Defender Antimalware Platform versions before or at version 4.18.26020.6 are affected by this vulnerability. Versions after version 4.18.26030.3011 are not affected by this vulnerability.
Impact
We estimate the impact of this vulnerability as medium.An attacker who has already gained initial access to your network (for example through phishing or stolen credentials) can use this vulnerability to elevate their privileges from a regular user to administrator level. This would allow them to:
- Take complete control of affected systems
- Install malware or ransomware
- Access sensitive data
- Move laterally through your network to compromise additional systems
- Create persistent backdoors for future access
Risk
We estimate the risk of this vulnerability as medium.The Dutch National Cyber Security Centre (NCSC-NL) has classified this vulnerability as High priority, and upgraded their initial assessment specifically because public exploit code became available[2]. The combination of widespread product deployment, available exploit code, and the strategic value of privilege escalation in multi-stage attacks creates a significant risk. As the vulnerability however requires an attacker to already have local access to a system, we estimate the risk of this vulnerability to be medium rather than high.
Mitigation
Microsoft has released security updates that fix this vulnerability. In most environments, Microsoft Defender updates itself automatically, which means your systems may already be protected.However, you should verify that the updates have been successfully installed, especially if:
- Your organization uses managed or delayed update policies
- You have disabled automatic updates for Microsoft Defender
- You manage updates through centralized tools like WSUS or SCCM
We recommend you to verify that the updates were applied. This can be performed manually on systems, or using Advanced Hunting within the Microsoft Defender portal.In order to verify this manually[1]:
- Open the Windows Security program. For example, type Security in the Search bar, and select the Windows Security program.
- In the navigation pane, select Virus & threat protection.
- Then click on Protection Updates in the Virus & threat protection section updates.
- Select Check for updates.
- In the navigation pane, select Settings, and then select About.
- Examine the Antimalware ClientVersion number. The update was successfully installed if the Malware Protection Platform version number or the signature package version number matches or exceeds the version number that you are trying to verify as installed.
- Navigate to the Microsoft Defender portal at https://security.microsoft.com/
- Open “Investigation & response” in the left-hand pane
- Open Hunting → Advanced hunting
- NOTE: This requires Microsoft Defender of Endpoint Plan 2
- Enter and execute the following query can be executed to get an overview of all vulnerable devices:
let threshold = parse_version("4.18.26030.3011"); DeviceTvmInfoGathering | extend AdditionalFields = parse_json(AdditionalFields) | extend AvPlatformVersion = tostring(AdditionalFields.["AvPlatformVersion"]) | where OSPlatform startswith "Windows" | project DeviceName, OSPlatform, AvPlatformVersion | where isnotempty(AvPlatformVersion) | extend AvPlatformV = parse_version(AvPlatformVersion) | where AvPlatformV < thresholdEnsure that any devices discovered using these methods are updated to Microsoft Defender Antimalware Platform version 4.18.26030.3011 or higher. This will be performed automatically by Microsoft, or by manually checking for updates as shown in the manual instructions above.
What will Northwave do?
We will monitor any developments regarding this vulnerability. If new critical information about this threat arises we will reach out to you. You can call us by phone or send us an email if you would like additional information.
E-mail: soc@northwave-cybersecurity.com
Do you have an incident right now? Call our Incident Response Team: 00800 1744 0000
Disclaimer applies, see below.
Sources
[1]: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825
[2]: https://advisories.ncsc.nl/2026/ncsc-2026-0115.html