Microsoft Defender Remote Code Execution Vulnerability
CVE-2026-122194 is a remote code execution vulnerability in Microsoft Defender (rated Critical, CVSS 8.8).
1 version
Facts
- Microsoft id
CVE-2026-122194- Products
- Microsoft Defender
- Severity
- Critical
- Impact
- Remote Code Execution
- CVSS
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
- Customer action required
- Yes
- Release
- 2026-Nov
- Assigned by
- Microsoft
- Weakness
- CWE-476: NULL Pointer Dereference
- MSRC revision
- 1.0
- Status pages
- Microsoft Defender status
- First captured by us
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2026-11-10:
Information published.
Microsoft says
Null pointer dereference in Microsoft Defender allows an unauthorized attacker to execute code over a network.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Other changes for Microsoft Defender
- Microsoft Defender Information Disclosure Vulnerability
- Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability
- Microsoft Defender Elevation of Privilege Vulnerability · Publicly disclosed
- Catch Microsoft Defender and Sentinel at Ignite 2026
- Enhancements to the Protection and Posture Insights report
- Now generally available: Discover local AI agents with Microsoft Defender
- Defending Linux in the age of AI-operated attacks
- Part 4: See, investigate, and measure email and collaboration attacks with Defender reporting
Last updated