PT-2026-32884 · Microsoft · Defender

Diffract + 2 · Published 2026-04-02 · Updated 2026-05-30 · CVE-2026-33825

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Microsoft Defender versions prior to 4.18.26030.3011 Windows 10 (affected versions not specified) Windows 11 (affected versions not specified) Windows Server 2019 and later (affected versions not specified)

Description Insufficient granularity of access control in Microsoft Defender allows an authorized local attacker to elevate privileges to SYSTEM level. The issue involves a time-of-check to time-of-use (TOCTOU) flaw in the signature update and remediation workflow. Attackers can leverage a logic chain involving the Windows Cloud Files API, Volume Shadow Copy (VSS), and Opportunistic Locks (Oplocks) to pause system processes and overwrite SYSTEM binaries or access locked registry hives such as SAM, SYSTEM, and SECURITY to extract administrative hashes. Real-world exploitation has been observed since April 10, 2026, with some attacks linked to compromised FortiGate SSL VPN connections. Technical details indicate the use of NTFS junctions and the Cloud Files API to trick the MsMpEng.exe process into spawning payloads with NT AUTHORITYSYSTEM tokens or overwriting files like 'C:Windowssystem32TieringEngineService.exe'.

Recommendations Update the Microsoft Defender antimalware platform to version 4.18.26030.3011 or higher. Restrict the Volume Shadow Copy Service to specific administrative users via Group Policy. Monitor for any process calling vssvc.exe that is not a recognized backup tool. Audit logs for unusual CldFlt (Cloud Files Mini Filter) activity originating from non-system directories.

Fix

DoS

LPE

RCE

Weakness Enumeration

CWE-1220

Related Identifiers

BDU:2026-05271

CVE-2026-33825

Affected Products

Defender

References · 122

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05271 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33825 · Security Note
• https://github.com/hashicorp/yamux · Note
• https://github.com/RussianPanda95/Yara-Rules · Note
• https://twitter.com/seoscottsdale/status/2047307018713874802 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2044470993956069752 · Twitter Post
• https://twitter.com/TheHackersNews/status/2044362588201570632 · Twitter Post
• https://twitter.com/raunak_yadush/status/2044749430407213260 · Twitter Post
• https://twitter.com/ElusivePrivacy/status/2057843827709219214 · Twitter Post
• https://twitter.com/inferlume_hq/status/2048791650143780890 · Twitter Post
• https://twitter.com/TweetThreatNews/status/2047254180218200124 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825 · Note
• https://twitter.com/threadlinqs/status/2044967878030397813 · Twitter Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note