Loading story…
Microsoft published a security advisory for an elevation of privilege vulnerability in the Microsoft Malware Protection Engine, tracked as CVE-2026-50656 and described as a Microsoft Defender Elevation of Privilege Vulnerability. The issue affects a core Defender component used for malware scanning and protection, prompting immediate attention from defenders monitoring endpoint security exposure.
The Canadian Centre for Cyber Security issued advisory AV26-607, urging organizations and administrators to review Microsoft’s guidance and apply the necessary updates as they become available. The notice reinforces that enterprises relying on Microsoft Defender should validate patch deployment and ensure affected systems receive the vendor’s remediation for CVE-2026-50656.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-607, urging users and administrators to review Microsoft's guidance for CVE-2026-50656 and apply updates when available.
Microsoft published a security advisory on an elevation of privilege vulnerability in the Microsoft Malware Protection Engine, identified as CVE-2026-50656 and described as a Microsoft Defender Elevation of Privilege Vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed active exploitation of two vulnerabilities in Microsoft Defender, **CVE-2026-41091** and **CVE-2026-45498**, prompting CISA to add both flaws to its **Known Exploited Vulnerabilities** catalog. **CVE-2026-41091** affects the Microsoft Malware Protection Engine and is a local privilege escalation issue tied to improper link resolution in Defender’s scanning logic, allowing an authenticated local attacker to obtain **SYSTEM** privileges. **CVE-2026-45498** affects the Microsoft Defender Antimalware Platform and can cause a denial of service that impairs or crashes Defender protection capabilities. Microsoft released fixes in **Microsoft Malware Protection Engine `1.1.26040.8`** and **Microsoft Defender Antimalware Platform `4.18.26040.7`**, with updates delivered through normal Defender mechanisms rather than a separate manual patch. CISA ordered U.S. federal civilian agencies to remediate or discontinue affected products by **June 3, 2026** under **BOD 22-01**. Reporting also linked the exploitation activity to public proof-of-concept releases by researcher **Nightmare Eclipse**, with Huntress observing attackers using Defender exploit code in the wild.
Jun 29, 2026
Microsoft published security advisories for two **Elevation of Privilege** flaws affecting Windows components: `CVE-2026-23660` in **Windows Admin Center in Azure Portal** and `CVE-2025-62472` in **Windows Remote Access Connection Manager**. Both entries were released through Microsoft's Security Update Guide, identifying separate privilege-escalation issues in enterprise-relevant Windows management and connectivity functionality. The disclosures indicate that attackers who successfully exploit the vulnerabilities could gain higher privileges on affected systems, increasing the risk of broader compromise after initial access. Organizations using Windows administrative tooling in Azure environments and systems relying on Remote Access Connection Manager should review Microsoft's advisories, determine exposure to the affected components, and prioritize applicable security updates and mitigation steps.
Jul 5, 2026
Microsoft published security advisories for several **elevation-of-privilege** vulnerabilities affecting Windows components and related software, including **Microsoft PC Manager** (`CVE-2025-21322`), **Windows Installer** (`CVE-2025-21331`, `CVE-2025-21373`), **Visual Studio** (`CVE-2025-49739`), **.NET** (`CVE-2025-55247`), **Windows Health and Optimized Experiences** (`CVE-2025-59241`), and **Host Process for Windows Tasks** (`CVE-2025-60710`). Microsoft also lists an earlier **Windows Storage** privilege-escalation issue, `CVE-2023-36399`, in its security guidance portal. The advisories provide limited public detail beyond product names and vulnerability class, but the grouping indicates broad exposure across both endpoint and developer environments where successful exploitation could allow an attacker to gain higher privileges on a target system. Organizations using affected Microsoft software should review the corresponding Security Update Guide entries, prioritize patch validation for Windows and developer-tooling assets, and assess whether privilege-escalation paths could be chained with other flaws or post-compromise activity.
Jul 5, 2026