Microsoft Defender Elevation of Privilege Vulnerability

CVE-2026-50656 is a link-following flaw (CWE-59) in Microsoft Defender's local service surface — the platform component that handles signature updates, quarantine I/O, and scan-result writes under NT AUTHORITY\SYSTEM. A logged-in low-privileged user plants a junction or NTFS reparse point along a path Defender touches during routine operations; Defender follows the link and performs a privileged file write/delete on an arbitrary target the user could not otherwise reach. Affected ranges per the MSRC advisory cover Defender platform builds prior to the June 2026 platform refresh and Defender for Endpoint sensor versions before the equivalent backport.

Microsoft's HIGH (7.8) rating is accurate, and we are not downgrading. The CVSS vector (AV:L/AC:L/PR:L/UI:N) honestly reflects that an attacker must already be logged in, but that is exactly the threat model EDR exists to defeat — a commodity infostealer or phishing payload arrives as a Medium-Integrity user and uses Defender itself as the SYSTEM primitive. E:F (functional exploit) plus the role of the affected component is what holds the score at HIGH.

Why this verdict

• Role multiplier — kernel-class security agent: Defender runs as SYSTEM on every managed Windows host; the chain ends in SYSTEM and EDR-tamper on the box. Per the noisgate role-multiplier rule, a bug *in* an EDR/AV component canonically occupies the high-value role on ≥10% of installs — in this case it is 100% — so the floor is at least HIGH.
• Friction — local-only (AV:L): Attacker must already be executing code as a non-admin user. That is real friction and is the only reason we are not at CRITICAL: there is no remote, unauthenticated path. We do not break the HIGH floor downward because the post-foothold scenario (commodity stealer, phishing payload, malicious insider) is the dominant real-world initial-access pattern.
• Friction — no internet exposure: Zero attack-surface from the perimeter. Useless to opportunistic mass exploitation; useful to any attacker already inside, which is every targeted intrusion.
• Exploit maturity — E:F Functional, no public PoC yet: Functional exploit code exists per Microsoft but is not commoditized. This argues against same-day mass abuse but does not change the floor; symlink-EoP primitives are well-understood and a public PoC is historically a matter of weeks.

Why not higher?

Not CRITICAL because the attack vector is strictly local (AV:L) — there is no wormable or remote-unauth path. CRITICAL is reserved for cases where the chain succeeds against an unauthenticated remote attacker or pivots across the fleet without per-host foothold; this requires interactive code execution per host first.

Why not lower?

Not MEDIUM because the affected component is a kernel-class security agent deployed on the entire Windows estate, and the outcome is SYSTEM plus EDR-tamper on the compromised host. Treating a Defender SYSTEM-EoP as MEDIUM would ignore the deployment-role blast radius rule — EDR bypass is what makes every other post-exploitation step easier.

1. Force Defender platform update to 4.18.26050.x fleet-wide — The Defender Antimalware Platform updates out-of-band from Windows cumulative updates via the Microsoft Malware Protection Center channel. Push via Intune Endpoint Security policy, ConfigMgr, or MpCmdRun.exe -SignatureUpdate -MMPC in a scheduled task. Per noisgate mitigation SLA for HIGH, this rollout must be complete within 30 days.
2. Enable Tamper Protection on every endpoint — Tamper Protection raises the cost of step 5 (sensor disable) materially and is the single highest-leverage post-EoP control. Enforce via Intune *Endpoint security → Antivirus → Windows Security Experience* or the Defender for Endpoint portal. Deploy within the same 30-day mitigation window.
3. Audit and minimize interactive logon rights on servers — This bug requires a logged-in user. Restrict SeInteractiveLogonRight on server tiers (especially Tier-0/Tier-1 — DCs, ADCS, backup servers) to break the precondition. GPO Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment. Implement within 30 days.
4. Hunt for reparse-point creation by non-admin users in Defender directories — Sysmon EventID 11 with a filter on TargetFilename matching C:\ProgramData\Microsoft\Windows Defender\* plus IntegrityLevel != System is a high-signal detection for stage 2 of the chain. Push the rule within 7 days; it is cheap insurance during the patch rollout window.
5. Verify Defender real-time protection is in Active (not Passive) mode where it is the primary AV — Ironically, hosts where Defender is Passive are *less* exposed to this bug — but you need to know which is which. Get-MpComputerStatus | Select AMRunningMode across the fleet inventories this in minutes.

Run on the target Windows host in an elevated PowerShell session (Defender platform queries require local admin to read all fields reliably). Invoke as .\Check-CVE-2026-50656.ps1. Returns exit code 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN. Suitable for ConfigMgr/Intune proactive remediation packaging.

#requires -Version 5.1
# Check-CVE-2026-50656.ps1
# noisgate verification: Microsoft Defender EoP (CWE-59 symlink)
# PATCHED  -> Defender platform >= 4.18.26050.0
# VULNERABLE -> Defender platform < 4.18.26050.0
# UNKNOWN  -> Defender not present / status unreadable

$ErrorActionPreference = 'Stop'
$FixedVersion = [Version]'4.18.26050.0'

try {
    $status = Get-MpComputerStatus -ErrorAction Stop
} catch {
    Write-Output 'UNKNOWN: Defender not installed or Get-MpComputerStatus unavailable.'
    exit 2
}

if (-not $status.AMProductVersion) {
    Write-Output 'UNKNOWN: AMProductVersion not reported.'
    exit 2
}

try {
    $current = [Version]$status.AMProductVersion
} catch {
    Write-Output "UNKNOWN: cannot parse AMProductVersion '$($status.AMProductVersion)'."
    exit 2
}

$rtp     = $status.RealTimeProtectionEnabled
$tamper  = $status.IsTamperProtected
$mode    = $status.AMRunningMode  # Normal | Passive | EDR Block Mode | SxS Passive Mode

Write-Output "Defender platform version : $current"
Write-Output "Real-time protection      : $rtp"
Write-Output "Tamper protection         : $tamper"
Write-Output "Running mode              : $mode"

if ($current -ge $FixedVersion) {
    Write-Output 'PATCHED'
    exit 0
} else {
    Write-Output "VULNERABLE: platform $current < fixed $FixedVersion (CVE-2026-50656)"
    if ($mode -eq 'Passive' -or $mode -eq 'SxS Passive Mode') {
        Write-Output 'NOTE: running in Passive mode — exposure reduced but still patch.'
    }
    exit 1
}

Sources

1. MSRC Update Guide — CVE-2026-50656
2. Microsoft — Manage Defender Antimalware Platform updates
3. Microsoft — Tamper Protection for Defender for Endpoint
4. MITRE CWE-59: Improper Link Resolution Before File Access
5. James Forshaw — symboliclink-testing-tools
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS Model
8. Microsoft — Get-MpComputerStatus PowerShell reference