CVE-2026-69414

Microsoft Defender Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 70th percentile. Fixed in 1.1.26080.3.

CVSS 3.17.8High EPSS percentile70th1.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1.1.26080.3Upgrade to this build

Published 2026-08-14Updated 2026-09-03Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft Malware Protection EngineAffected: ≥ 1.1.0.0, < 1.1.26080.3Upgrade to: 1.1.26080.3Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your environment uses Microsoft Defender / Microsoft Malware Protection Engine and whether the installed Defender/Malware Protection Engine update level matches the latest guidance from Microsoft for CVE-2026-69414.
Read Microsoft’s official remediation for CVE-2026-69414 in the MSRC Update Guide and plan to apply the security update it lists.
Apply the Microsoft fix as soon as it is available via your normal Windows update / Defender update process, and confirm the update is installed on all business-critical endpoints.
For any systems that cannot be updated quickly, prioritize restricting access to those machines (reduce attacker “foothold” opportunities) until patching is complete.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

6 publishers

Security researcher Abdelhamid Naceri released 'BigDiskBuster,' a zero-day proof-of-concept that blocks Microsoft Defender antivirus updates on all supported Windows versions.
as reported · Sep 22, 2026·BleepingComputer summary
Vendor patch released
as reported · Aug 17, 2026·BleepingComputer summary

Sourced from public security reporting — each date is when it was published, not when it happened. 4 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".

In plain language

Written by AI from the record

CVE-2026-69414 is a Microsoft Defender (Microsoft Malware Protection Engine) bug that can let an attacker with a foothold gain higher privileges; a typical small business should patch when the fix is released, especially if machines are exposed to attacks.

CVE-2026-69414 is an elevation-of-privilege flaw in Microsoft Malware Protection Engine (Microsoft Defender) that can be triggered locally by an attacker after gaining some access, potentially allowing them to run with higher privileges.

If you're affected

Run malicious code with higher access
Compromise security tooling integrity
Increase ransomware impact if breached
Potential full system takeover

What is it

Think of Microsoft Defender like the “security guard” on your computers. This vulnerability is a weakness that could let an attacker who already managed to get onto a machine “climb the ladder” and gain higher permissions than they should have. That can make it easier to damage systems, steal data, or disable defenses if an attacker’s initial access is already in place.

Who is affected

This matters if you run Microsoft Defender on Windows systems that include the Microsoft Malware Protection Engine (the Defender scanning/defense component). It’s typically a risk only if an attacker can reach the machine in a way that provides some local access—because the vulnerability is an elevation-of-privilege issue triggered from a local position. If attackers can’t get onto the endpoint, this specific bug is not the primary concern.

How urgent is it

This is an AMBER issue: it’s a high-severity elevation-of-privilege vulnerability, but there’s no confirmed public exploit code and it is not listed in the CISA KEV catalog. Still, because it could help an attacker gain higher privileges after landing on a device, you should patch as part of your next update window as soon as Microsoft’s fix is available.

What to do — in detail

Confirm whether you’re exposed

Identify where Microsoft Defender is used:
- Check that endpoints run Microsoft Defender and that the Microsoft Malware Protection Engine is present (standard Defender installs typically include it).
Check the current update level:
- On Windows endpoints, review installed Defender/Malware Protection Engine update status using your normal endpoint management tools (e.g., your security management console) or the information Microsoft provides in your update reporting.
Validate against Microsoft’s official fix:
- Use the MSRC Update Guide entry for CVE-2026-69414 to determine the specific remediation update Microsoft recommends for your environments.

Patch / upgrade path

Apply Microsoft’s remediation update listed for CVE-2026-69414:
- Follow your organization’s standard patching mechanism (Windows Update / Defender update channels / endpoint management).
- Confirm the update is installed on each affected endpoint.
If your organization uses multiple release rings:
- Patch test/small pilot first, then roll out broadly once confirmed.

Temporary workaround (if patching is delayed)

Reduce the chance of an attacker getting a local foothold:
- Restrict administrative access to only those who need it.
- Keep endpoint access tightly controlled (least privilege, disable unused accounts, and review remote access methods).
- Ensure anti-malware real-time protection remains enabled while waiting for the fix.

What to monitor after patching

Ensure Defender/Malware Protection Engine reports healthy status and that endpoint security events look normal.
Watch for alerts related to privilege escalation or unusual process behavior on endpoints, especially on machines that have recently had suspicious activity.

CISA due date

No KEV entry was found for this CVE, so no CISA KEV-driven deadline is available from the provided findings.

Technical context

CVE-2026-69414 is an elevation-of-privilege vulnerability in Microsoft Malware Protection Engine (part of Microsoft Defender) referenced by Microsoft as “ShieldBreak.” The weakness is categorized under CWE-284 (Improper Access Control) and CWE-269 (Privilege Management). Based on the provided information, the attack context is local (the scenario assumes the attacker can operate from a local position after gaining access), which aligns with the CVSS vector indicating local attack conditions.

Exploitation status: not listed in the CISA KEV catalog and there is no public exploit code on record in the provided findings, so widespread exploitation is not confirmed here. The findings include only a low predicted likelihood (an EPSS-style prediction) and a flat trend, but public guidance prioritizes applying Microsoft’s remediation because no confirmed KEV exploitation is known.

Fix availability: Microsoft has a remediation entry in the MSRC Update Guide for this CVE, but the provided findings do not include a specific fixed version number, so the exact target level should be taken directly from the MSRC link above.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS70th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.3% chance of exploitation activity in the next 30 days, which ranks it in the 70th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

14 events over 20 days, from the signal feeds we watch.

2026-09-03Patch availablerecord updated
2026-08-20Patch availablerecord updated
2026-08-19Patch availablerecord updated
2026-08-18Patch availablerecord updated, record updated
2026-08-17Record updated
2026-08-14Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- malware protection engineSecurity ProductOn-premSecurity Products / endpoint-av-edr
- Microsoft Malware Protection EngineSecurity ProductOn-premSecurity Products / endpoint-av-edr

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable