Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.0

Microsoft Defender for Endpoint for Mac Privilege Elevation Risk

CVE-2026-56178 · published 3 months ago
Summary

An attacker with permission can misuse Microsoft Defender for Endpoint for Mac to gain higher-level access on the system. This is a concern for businesses because it could allow an unauthorized user to access sensitive information. To protect yourself, ensure you're running the latest version of Microsoft Defender for Endpoint for Mac.

What to do
  • Update microsoft microsoft defender for endpoint for mac to version 101.26042.0020 or later.
  • Update microsoft defender_for_endpoint to version 101.26042.0020 or later.
Affected software
VendorProductAffected versions
microsoft microsoft defender for endpoint for mac < 101.26042.0020
microsoft defender_for_endpoint >= 101.0.0, < 101.26042.0020
cpe:2.3:a:microsoft:defender_for_endpoint:*:*:*:*:*:macos:*:*
Original advisory text
Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.0 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition
Timeline
Published14 Jul 2026
Updated4 Nov 2026
First seen14 Jul 2026
Sources
CVE-2026-56178 · NVD
CVE-2026-56178 · MITRE
Track software like this
Free during beta