Microsoft Defender is vulnerable to an actively exploited local privilege escalation flaw that allows an authorized attacker to gain elevated system permissions.

This flaw involves improper link resolution before file access (CWE-59). An authorized local attacker can manipulate symbolic or hard links to redirect privileged file operations performed by the Malware Protection Engine, resulting in local privilege escalation.

The exploitation of this vulnerability poses a severe risk to organizational security, as it allows a local user to bypass security controls and gain escalated privileges on the host system. With a CVSS score of 9.5, this is considered critical, and the fact that it is currently being exploited in the wild significantly increases the likelihood of unauthorized system compromise, lateral movement, and full administrative control by malicious actors.

Immediate Action: Update the Microsoft Malware Protection Engine to version 1.1.26040.8 or later immediately to resolve the vulnerable component.

Proactive Monitoring: Monitor system logs for unusual file system activity or unexpected process behavior involving the Microsoft Malware Protection Engine service.

Compensating Controls: Restrict local user permissions where possible and ensure that endpoint detection and response (EDR) solutions are configured to alert on unauthorized attempts to create or modify symbolic links in sensitive directories.

Public Exploit Available: Yes, multiple public proofs-of-concept are available via GitHub repositories.

Given the critical severity and the confirmation of active exploitation in the wild, organizations must prioritize the deployment of the updated Malware Protection Engine. Administrators should ensure that all systems running Microsoft Defender receive the update immediately to prevent potential local privilege escalation attacks.