Advisory ID: ngCERT-2026-040006
SUMMARY
ngCERT has identified a newly disclosed zero-day vulnerability (CVE-2026-33825) affecting the Microsoft Defender Antimalware Platform. The vulnerability was disclosed on 14 April 2026, as part of Microsoft Patch Tuesday updates. This flaw allows threat actors to perform elevation-of-privilege (EoP) attacks, enabling them to bypass standard access controls and gain SYSTEM-level privileges on affected Windows systems. Although exploitation requires prior access to a target machine, this vulnerability poses a significant risk in post-compromise scenarios and is likely to be exploited by advanced cybercriminals to achieve full system control. Accordingly, ngCERT strongly advise government, private organisations, and the general public to urgently apply the relevant security updates to mitigate potential exploitation.
DESCRIPTION
The vulnerability exists within the Microsoft Defender Antimalware Platform due to insufficient access-control granularity (CWE-1220). This weakness allows improper handling of privileged operations within Defender components. An attacker with local access to a system can exploit this flaw by interacting with vulnerable Defender processes or services in a way that bypasses intended permission boundaries. Successful exploitation results in privilege escalation to the SYSTEM level, the highest privilege tier in Windows environments. Once elevated, the attacker can execute arbitrary code, manipulate system processes, disable security controls, and establish persistent access. This vulnerability is particularly dangerous because Microsoft Defender operates with elevated privileges by default, making it an attractive target for attackers seeking to expand their control after initial compromise. Although the vulnerability does not allow direct remote exploitation, it can be combined with other attack vectors such as phishing, malware infection, or remote code execution to achieve full system compromise.
Damage: Critical
Probability: High
Platform(s): Windows systems
CONSEQUENCES
Successful exploitation of the vulnerability could lead to:
- Privilege escalation.
- Security control bypass.
- Persistence.
- Credential theft and lateral movement.
- Full system compromise.
SOLUTION/MITIGATION
The following mitigations are strongly recommended:
- Apply Microsoft Security Updates Immediately.
- Ensure Defender Platform is Up to Date.
- Limit Local Access.
- Enable Endpoint Detection and Response (EDR).
- Monitor Defender Services.
- Implement Application Control Policies.
- Conduct Regular Patch Management.
- User Awareness and Phishing Protection
HYPERLINK