CVE-2025-26684

6.7 mediumEPSS 0.4%

Medium (6.7) in microsoft defender for endpoint. EPSS 0.4% chance of exploitation in the next 30 days.

External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.

Severity

6.7 medium

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWEs: CWE-610, CWE-73
Published: 2025-05-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19