Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability
CVE-2026-56178 is an elevation of privilege vulnerability in Microsoft Defender for Endpoint (rated Important, CVSS 5.5).
1 version
Facts
- Microsoft id
CVE-2026-56178- Products
- Microsoft Defender for Endpoint
- Severity
- Important
- Impact
- Elevation of Privilege
- CVSS
- 5.5
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
- Customer action required
- Yes
- Release
- 2026-Jul
- Assigned by
- Microsoft
- Weakness
- CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
- MSRC revision
- 1.0
- Status pages
- Microsoft Defender status
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2026-07-14:
Information published.
Microsoft says
Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Other changes for Microsoft Defender
- Microsoft Defender Remote Code Execution Vulnerability
- Microsoft Defender Information Disclosure Vulnerability
- Microsoft Defender Elevation of Privilege Vulnerability · Publicly disclosed
- Catch Microsoft Defender and Sentinel at Ignite 2026
- Enhancements to the Protection and Posture Insights report
- Now generally available: Discover local AI agents with Microsoft Defender
- Defending Linux in the age of AI-operated attacks
- Part 4: See, investigate, and measure email and collaboration attacks with Defender reporting
Last updated