Executive brief
A security vulnerability in Microsoft Defender for Endpoint on Mac could allow an authorized user to access private personal information they should not be able to see. Microsoft Defender is an antivirus and security suite used to protect corporate devices from malware and cyberattacks. While an exploit requires the attacker to already have local access to the system, it could lead to the unauthorized disclosure of sensitive user data.
Technical details
Microsoft Defender for Endpoint for Mac contains an information disclosure vulnerability (CWE-359) due to the improper exposure of private personal information to unauthorized actors. An attacker with local access and low privileges can exploit this flaw to disclose sensitive information, though the attack complexity is rated as high, suggesting specific conditions or timing may be required. The vulnerability affects versions starting from 101.0.0 up to 101.26042.0020. Microsoft has addressed this issue in subsequent updates.
Affected products
- Microsoft Microsoft Defender for Endpoint for Mac 101.0.0 to 101.26042.0020
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory