What happened

CISA added CVE-2026-33825 to the Known Exploited Vulnerabilities (KEV) Catalog, flagging active exploitation of a Microsoft Defender flaw on 2026-04-22 (CISA KEV). The entry describes “Insufficient Granularity of Access Control” in Microsoft Defender that allows an authorized attacker to escalate privileges locally (CISA KEV). CISA sets a remediation due date of 2026-05-06 and instructs organizations to apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use if no mitigations are available (CISA KEV).

NIST has published a corresponding entry for CVE-2026-33825 in the National Vulnerability Database, providing the canonical tracking record for the issue (NVD entry). The CVE is also registered with MITRE’s database, confirming assignment details for cross-reference and tooling ingestion (MITRE CVE). CISA notes ransomware use is currently unknown for this CVE, though exploitation is confirmed by virtue of KEV listing (CISA KEV).

Why it matters

Microsoft Defender is a core security control on Windows endpoints, and privilege escalation inside a security product punches a hole through the local trust boundary when abused by an attacker with user-level access (NVD entry). The CISA description makes the impact explicit: an authorized attacker can achieve local privilege escalation (LPE) through this flaw, turning a low-priv foothold into system-level control (CISA KEV). KEV inclusion signals real-world exploitation, shifting this from a theoretical risk to an operational priority for defenders (CISA KEV).

While CISA does not attribute this to specific campaigns, the “ransomware use: unknown” note does not reduce urgency—the agency’s KEV process only lists issues with evidence of exploitation in the wild (CISA KEV). In practical terms, any local compromise path—phishing, drive-by, or software supply chain—gets a free upgrade to admin through a working LPE, which collapses containment and accelerates lateral movement within minutes (NVD entry).

Technical detail

CVE-2026-33825 maps to CWE-1220, “Insufficient Granularity of Access Control,” where permissions or policy boundaries are too coarse, allowing operations that exceed intended authority (CWE-1220). In this case, CISA’s description indicates the control weakness resides in Microsoft Defender and can be triggered by an already authorized (non-admin) attacker to escalate locally (CISA KEV). NIST tracks this CVE, enabling consumers to align SBOMs, asset inventories, and scanner plugins to the identifier for automated risk rollups (NVD entry).

CWE-1220 failures commonly arise when role-based or ACL-based checks lump sensitive operations under broader permissions, enabling unintended write or execute actions on protected resources (CWE-1220). For a system-level security service like Defender, any lapse in privilege separation or policy enforcement can inadvertently grant code paths that pivot from user context to elevated control, matching the LPE outcome CISA highlights (CISA KEV). The public records for this CVE do not enumerate subcomponents or exploit steps, so defenders should plan generically around local EoP abuse in Defender’s trust boundary until vendor guidance is applied (NVD entry).

Attack preconditions are straightforward: an attacker must already be authorized on the host (e.g., a compromised standard user), after which this flaw enables privilege escalation locally per the CISA summary (CISA KEV). That profile fits common post-exploitation chains where initial access is noisy but limited, and a reliable LPE stabilizes control, disables defenses, and unlocks credential theft and persistence routes on the endpoint (NVD entry). The MITRE CVE record supports standardized cross-reference for detection content and ticketing systems, easing fleet-wide tracking (MITRE CVE).

Defense

• Patch and mitigations: CISA’s required action is explicit—apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue use where mitigations are unavailable (CISA KEV). Treat the KEV due date of 2026-05-06 as a hard SLA for remediation and reporting, especially for federal networks and regulated environments (CISA KEV).
• Asset and exposure verification: Align asset inventories and vulnerability scanners to CVE-2026-33825 to confirm coverage and remediation status at scale, leveraging the canonical NVD identifier in tooling and dashboards (NVD entry). Ensure that any automated exception process flags this CVE as non-deferrable due to KEV status (CISA KEV).
• Compensating controls: Until patches or mitigations are confirmed, increase scrutiny on Defender-related service operations and configuration changes originating from non-admin user contexts, a common path in local EoP abuse scenarios (NVD entry). Where feasible, restrict local administrative rights exposure and enforce hardened baselines that limit service control and privileged file write surfaces for standard users (CWE-1220).
• Detection guidance: Hunt for signs of local privilege escalation attempts involving security service boundaries, including unusual modifications to security service configurations, service start/stop attempts by unprivileged principals, and unexpected scheduled task creation referencing security components (NVD entry). Prioritize telemetry that correlates user-context actions immediately preceding service-level changes to shorten MTTD on local EoP runs (CISA KEV).

Lyrie Verdict

This is the kind of post-exploitation accelerant autonomous adversaries love: a reliable LPE inside the endpoint security layer that flips a user foothold into full control (CISA KEV). Lyrie auto-ingests KEV updates and promotes impacted components to high-sensitivity watchlists within seconds, driving machine-speed detections on Defender-boundary change attempts from user contexts (CISA KEV). Concretely, we correlate user-origin events with privileged service-control operations and configuration writes tied to security services, and we interdict when a non-admin principal attempts elevation-adjacent actions consistent with local EoP workflows (NVD entry). That closes the window where a rogue AI agent could autonomously escalate, disable protections, and pivot—before human eyes ever see the alert (MITRE CVE).