CVE-2026-102204: Microsoft Microsoft Defender for Endpoint Elevation of Privilege Vulnerability
Published Oct 13, 2026
·Updated
Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
Other sources
Microsoft Microsoft Defender for Endpoint Elevation of Privilege Vulnerability
— Microsoft
Affected Software
2 affected components
Microsoft Microsoft Defender for Endpoint
Microsoft Defender for Endpoint for Linux
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·07:01 PM
Data Sourced
via MITRE·07:01 PM
DescriptionSeverity
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker must already be authorized on the affected system and have local access. The issue enables elevation of privilege locally; the provided data does not indicate that it is remotely exploitable.
2
Which products are identified as affected?
The listed affected products are Microsoft Defender for Endpoint and Microsoft Defender for Endpoint for Linux.
3
What security impact could successful exploitation have?
Successful exploitation could allow high-impact compromise of confidentiality, integrity, and availability on the affected system through local privilege elevation.