Microsoft Defender For Endpoint vulnerabilities

16 CVEs affecting Microsoft Defender For Endpoint, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-54123, published 2026-08-11.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-23278, published 2022-03-09. Medium severity, CVSS 5.9. EPSS: 1.9% chance of exploitation in the next 30 days. Microsoft Defender for Endpoint Spoofing Vulnerability
• CVE-2022-33637, published 2022-07-12. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. Microsoft Defender for Endpoint Tampering Vulnerability
• CVE-2024-49057, published 2024-12-12. High severity, CVSS 8.1. EPSS: 1.7% chance of exploitation in the next 30 days. Microsoft Defender for Endpoint on Android Spoofing Vulnerability
• CVE-2024-49071, published 2024-12-12. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose information over a network.
• CVE-2025-47161, published 2025-05-15. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
• CVE-2024-43614, published 2024-10-08. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. Relative path traversal in Microsoft Defender for Endpoint allows an authorized attacker to perform spoofing locally.
• CVE-2024-21315, published 2024-02-13. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability
• CVE-2026-21537, published 2026-02-10. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network.
• CVE-2022-35828, published 2022-09-13. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability
• CVE-2026-54123, published 2026-08-11. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.

Latest

• CVE-2026-56178, published 2026-07-14. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
• CVE-2026-50658, published 2026-07-14. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. Time-of-check time-of-use (toctou) race condition in Microsoft Defender allows an authorized attacker to elevate privileges locally.
• CVE-2026-50657, published 2026-07-14. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.
• CVE-2026-45647, published 2026-06-09. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
• CVE-2025-59497, published 2025-10-14. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Linux allows an authorized attacker to deny service locally.
• CVE-2025-26684, published 2025-05-13. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.