CVE coverage
View on NVD →
CVE-2026-33825
CVSS 7.8
Actively exploited (KEV)
9 detections found
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Windows Non-System Process Querying Definition Update | production | 2026-10-08 |
| splunk | Windows Admin Password Changed by Non-Admin | production | 2026-09-23 |
| splunk | Windows Suspicious Defender Update Activity in INetCache | production | 2026-07-20 |
| splunk | Windows Cloud Files Filter Log Created by Non-System Process | production | 2026-05-01 |
| splunk | Windows Suspicious Child Process of TieringEngineService.exe | production | 2026-05-01 |
| splunk | Windows VSSVC Process Accessing Defender Engine | production | 2026-05-01 |
| splunk | Windows Suspicious Burst of Password Changes | production | 2026-04-29 |
| splunk | Windows MsMpEng Writing to System32 | production | 2026-04-27 |
| splunk | Windows Suspicious Defender Engine or Signature Files Created | production | 2026-04-27 |