CVE-2025-47161: Microsoft Defender for Endpoint Elevation of Privilege Vulnerability

Overview

Severity
High (CVSS 7.8)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Not Exploited
Exploitation Likelihood
Unlikely
Patch Tuesday
2025-May
Released
2025-05-15
Last Updated
2025-07-08
EPSS Score
4.36% (percentile: 89.0%)

Description

Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.

FAQ

How can I verify that the update is installed? Customers wanting to ensure the client has been updated can run the MDE Client Analyzer on the device. When running the analyzer on a Windows device that does not have the security update, the analyzer will present a warning (ID 121035) indicating missing patch and directing to relevant online article. Additionally, if the update is installed, but the Anti-Spoofing capability is not in a stable state, the analyzer will present warning (ID 121036) indicating an issue and providing additional online guidance or callout to reach out to Microsoft support if issue persists. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Affected Products (1)

System Center

  • Microsoft Defender for Endpoint for Linux

Security Updates (1)

Acknowledgments

Rich Mirch with <a href="https://www.stratascale.com/">Stratascale Cyber Research Unit</a>

Revision History

  • 2025-05-15: Information published.
  • 2025-07-08: Updated links to security updates. This is an informational change only.