CVE-2026-50658: Microsoft Defender for Endpoint for Mac privilege escalation via TOCTOU

CVE-2026-50658 · Severity: high · CVSS 7 · Published 2026-07-14

Microsoft Defender for Endpoint, a security tool used to protect enterprise computers from malware and cyber threats, contains a vulnerability that could allow a user with limited access to gain higher-level administrative permissions. By exploiting a timing flaw during file checks, an attacker who already has a foothold on a Mac system could bypass security restrictions to gain full control over the device. This could lead to the theft of sensitive data or the disabling of security protections.

Technologies: Microsoft Defender for Endpoint. Vendors: Microsoft.

Quick answers

Is CVE-2026-50658 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50658 being exploited in the wild.
How severe is CVE-2026-50658?
High severity, with a CVSS score of 7, published 14 July 2026.
Which products and versions are affected?
Microsoft Defender for Endpoint 101.0.0 to 101.26042.0020.
Is there a fix for CVE-2026-50658?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50658 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-50658?
Check whether you run Microsoft Defender for Endpoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in Microsoft Defender for Endpoint for Mac (versions 101.0.0 through 101.26042.0020). The vulnerability, classified as CWE-367, occurs when the application checks a file property or state but the state changes before the file is actually used. An attacker with local user access (PR:L) can exploit this high-complexity (AC:H) race condition to execute code with elevated privileges. Successful exploitation grants the attacker full confidentiality, integrity, and availability impact on the affected system. Microsoft has addressed this issue in updated versions of the Defender client.

Affected products

  • Microsoft Microsoft Defender for Endpoint for Mac 101.0.0 to 101.26042.0020

Timeline

  • 2026-07-14: advisory: Initial advisory published by Microsoft and NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.