Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
How can I verify that the update is installed?
Customers wanting to ensure the client has been updated can run the MDE Client Analyzer on the device. When running the analyzer on a Windows device that does not have the security update, the analyzer will present a warning (ID 121035) indicating missing patch and directing to relevant online article. Additionally, if the update is installed, but the Anti-Spoofing capability is not in a stable state, the analyzer will present warning (ID 121036) indicating an issue and providing additional online guidance or callout to reach out to Microsoft support if issue persists.
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Security updates
101.25022.0002 — https://learn.microsoft.com/en-us/defender-endpoint/linux-whatsnew#releases-for-defender-for-endpoint-on-linux
Vulnerabilities 1
-
High 7.8CVE-2025-47161 Public exploit
Microsoft Defender for Endpoint Elevation of Privilege Vulnerability
Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
Revision history
-
#2
Updated links to security updates. This is an informational change only.
-
#1
Information published.
References
-
CVE-2025-47161 Microsoft Defender for Endpoint Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47161
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss