CVE-2026-45647: Microsoft Defender for Endpoint privilege escalation via TOCTOU race condition

CVE-2026-45647 · Severity: medium · CVSS 5.5 · Published 2026-06-09

A security vulnerability exists in Microsoft Defender for Endpoint, the primary security software used to protect corporate computers from malware and cyberattacks. An attacker who already has basic access to a computer could exploit a timing flaw to gain higher-level administrative permissions. This could allow them to bypass security controls or modify system files that should normally be protected.

Technologies: Microsoft Defender for Endpoint. Vendors: Microsoft.

Quick answers

Is CVE-2026-45647 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45647 being exploited in the wild.
How severe is CVE-2026-45647?
Medium severity, with a CVSS score of 5.5, published 9 June 2026.
Which products and versions are affected?
Microsoft Defender for Endpoint.
Is there a fix for CVE-2026-45647?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45647 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-45647?
Check whether you run Microsoft Defender for Endpoint. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Time-of-Check Time-of-Use (TOCTOU) race condition exists within Microsoft Defender for Endpoint, classified as CWE-367. The vulnerability occurs when the application checks a resource (such as a file or configuration) but the state of that resource changes before it is actually used by the service. An attacker with local access and low-level privileges can exploit this window of opportunity to manipulate system processes. Successful exploitation allows the attacker to elevate their privileges to a higher level, potentially gaining unauthorized integrity over system components. The attack requires local authentication but no user interaction.

Affected products

  • Microsoft Defender for Endpoint

Timeline

  • 2026-06-09: advisory: Initial disclosure by Microsoft and NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.