Time-of-check Time-of-use Race Condition in Microsoft Defender for Endpoint

CVE-2026-45647

What is CVE-2026-45647?

A race condition vulnerability exists in Microsoft Defender for Endpoint that permits an authorized attacker to exploit the time-of-check time-of-use (TOCTOU) scenario, enabling them to elevate their privileges locally. This flaw affects the way the product validates conditions before allowing actions to be executed, potentially leading to unauthorized access and misuse of system privileges. Organizations using Microsoft Defender for Endpoint should prioritize applying the recommended updates to mitigate the risk associated with this vulnerability.

References