Is CVE-2026-33825 actively exploited?

Yes. CVE-2026-33825 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2026-33825 be exploited remotely?

No. CVE-2026-33825 requires local access to exploit.

What is the CVSS score of CVE-2026-33825?

CVE-2026-33825 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-33825

HIGHCISA KEVIN THE WILD

CVE-2026-33825

CWE-1220Published: April 14, 2026· Updated: Apr 20, 2026

7.8

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.2th

Official Description

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

NVD Source

Technical Analysis

CVE-2026-33825 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

CISA has added CVE-2026-33825 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

Microsoft1 product

defender antimalware platform

Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

ACTIVE EXPLOITATIONConfirmed exploitation in the wild

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825

News & Research Mentioning CVE-2026-33825

BlueHammer Vulnerability Exploited in Ransomware Attacks

SecurityWeek· Jun 30, 2026

The Microsoft Defender vulnerability CVE-2026-33825 was exploited in the wild as a zero-day before patches were released. The post BlueHammer Vulnerability Exploited in Ransomware Attacks appeared first on SecurityWeek. [xlite_meta score:62 src:SecurityWeek xlite_fp:33de9d86a8681e403764362203aa6a7f597ac7464020fda3ba13e774a52ba14d]

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Alerts· Apr 22, 2026

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-33825 Microsoft Defender Insufficient Granularity of Access Control Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FC [xlite_meta score:48 src:CISA Alerts xlite_fp:345b8cecbe3c7344ec4d3f7bf5d5dc2274d75b95073b3d3e6b4d4c59174024fb]