CVE-2026-45647: Microsoft Defender for Endpoint Privilege Escalation Race Condition

Technical summary

CVE-2026-45647 is a TOCTOU race condition (CWE-367) in Microsoft Defender for Endpoint's privilege handling logic. The vulnerability exists because the software checks permissions or system state at one point in time, but by the time it acts on that check moments later, an authorized attacker can manipulate the intervening conditions. This classic concurrency flaw allows local privilege escalation without requiring user interaction or network access. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) reflects local attack surface, low complexity, required low privileges, high integrity impact (privilege elevation), and no confidentiality or availability loss.

Business impact

Privilege escalation on endpoint protection software creates an internal security contradiction: the tool meant to defend systems becomes a vector for lateral movement or persistent access by insiders or compromised accounts. An attacker with standard user credentials could elevate to administrator or SYSTEM level, potentially allowing malware installation, configuration tampering, policy bypass, or lateral movement within the network. In environments with strict role-based access controls, this undermines the access boundary between user tiers.

Affected systems

Microsoft Defender for Endpoint deployments are affected. Organizations running this security tool on Windows endpoints—particularly those relying on it as a primary endpoint detection and response (EDR) solution—should audit their installation versions. The vulnerability requires local access, so it primarily impacts endpoints where users have non-admin accounts that need to remain isolated from administrative functions.

Exploitability

Exploitation requires an authorized local user account and knowledge of the specific TOCTOU window. It is not remotely exploitable and does not require user interaction. The attack complexity is low once an attacker understands the race condition mechanics, but successful exploitation may require repeated attempts or precise timing. This is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting in-the-wild exploitation has not yet been observed or widely reported at the time of initial disclosure.

Remediation

Apply the latest security update from Microsoft for Defender for Endpoint. Verify the patch version against Microsoft's official security advisory to ensure you are deploying the correct build. Organizations should prioritize deployment to systems where standard users require isolated privileges or where insider risk is a concern. Until patched, restrict local user account creation or enforce privileged access management (PAM) controls to minimize the number of accounts capable of launching the attack.

Patch guidance

Contact Microsoft Security Response Center or review the official Defender for Endpoint update page for the specific patched version number and deployment guidance. Security updates are typically released through Windows Update and Microsoft Endpoint Configuration Manager. Test patches in a non-production environment first, as Defender updates can occasionally affect system performance or antimalware exclusions. Verify patch deployment using your organization's software inventory or EDR telemetry to confirm all endpoints have received the update.

Detection guidance

Look for suspicious privilege escalation attempts on systems running Defender for Endpoint, particularly processes spawned by low-privileged user accounts acquiring SYSTEM or administrator tokens. Monitor Windows Security Event Log (Event ID 4672 for special privileges assigned, Event ID 4688 for process creation) for abnormal escalations. EDR tools should flag unexpected privilege elevation from the Defender process path or unusual interactions with Windows kernel APIs related to token handling. Correlate timing of multiple failed process creation attempts, which may indicate race condition exploitation attempts.

Why prioritize this

Although the CVSS score is MEDIUM (5.5), the nature of the vulnerability—privilege escalation in a security tool—warrants elevated attention. Patching should occur relatively soon because successful exploitation directly compromises the integrity of endpoint security controls. However, the requirement for local authenticated access and the absence of KEV listing mean this is lower urgency than remote unauthenticated vulnerabilities. Prioritize based on your organization's user privilege model: organizations with strict separation of user and admin accounts should patch sooner than those with widespread admin rights.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects the local-only attack vector and requirement for low-level privileges, which constrains the threat surface. However, the high integrity impact of privilege escalation and the criticality of the affected software (endpoint protection) elevate business risk beyond the numerical score. The absence of network or user interaction requirements (UI:N) and the attack's low complexity relative to typical TOCTOU exploits suggest that once a working exploit is public, many systems could become quickly vulnerable. Organizations should treat this as a priority patch despite the mid-range CVSS number.

Frequently asked questions