Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
How can I verify that the update is installed?
Customers wanting to ensure the client has been updated can run the MDE Client Analyzer on the device. When running the analyzer on a Windows device that does not have the security update, the analyzer will present a warning (ID 121035) indicating missing patch and directing to relevant online article. Additionally, if the update is installed, but the Anti-Spoofing capability is not in a stable state, the analyzer will present warning (ID 121036) indicating an issue and providing additional online guidance or callout to reach out to Microsoft support if issue persists.
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Security updates
101.25032.0010 — https://learn.microsoft.com/en-us/defender-endpoint/linux-whatsnew#releases-for-defender-for-endpoint-on-linux
Vulnerabilities 1
-
Medium 6.7
Microsoft Defender Elevation of Privilege Vulnerability
External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
Revision history
-
#3
Updated the build numbers. This is an informational update only.
-
#2
Updated links to security updates. This is an informational change only.
-
#1
Information published.
References
-
CVE-2025-26684 Microsoft Defender Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26684
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss