CVE-2026-102204: high-severity vulnerability in Microsoft Defender for Endpoint for Linux
Microsoft Microsoft Defender for Endpoint Elevation of Privilege Vulnerability
Published
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.8
exploitation probability
—
observed exploitation
nono source reports it
Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Affected products
Microsoft · Microsoft Defender for Endpoint for LinuxRelated CVEs — Microsoft Defender for Endpoint for Linux
In the same product, most dangerous first.
CVE-2022-23278MEDIUMMicrosoft Defender for Endpoint Spoofing VulnerabilityEPSS 1.9%CVE-2022-33637MEDIUMMicrosoft Defender for Endpoint Tampering VulnerabilityEPSS 1.7%CVE-2025-47161HIGHMicrosoft Defender for Endpoint Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2024-43614MEDIUMMicrosoft Defender for Endpoint for Linux Spoofing VulnerabilityEPSS 0.6%CVE-2026-21537HIGHMicrosoft Defender for Endpoint Linux Extension Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-26684MEDIUMMicrosoft Defender Elevation of Privilege VulnerabilityEPSS 0.4%