CVE-2025-26678
published 2025-04-08CVE-2025-26678: Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally.
PriorityP344high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.48%
37.4th percentile
Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1809 | < 10.0.17763.7136 | 10.0.17763.7136 |
| microsoft | windows_10_21h2 | < 10.0.19044.5737 | 10.0.19044.5737 |
| microsoft | windows_10_22h2 | < 10.0.19045.5737 | 10.0.19045.5737 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.7136 | 10.0.17763.7136 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.5737 | 10.0.19044.5737 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.5737 | 10.0.19045.5737 |
| microsoft | windows_11_22h2 | < 10.0.22621.5189 | 10.0.22621.5189 |
| microsoft | windows_11_23h2 | < 10.0.22631.5189 | 10.0.22631.5189 |
| microsoft | windows_11_24h2 | < 10.0.26100.3775 | 10.0.26100.3775 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.5189 | 10.0.22621.5189 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.5189 | 10.0.22631.5189 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.5189 | 10.0.22631.5189 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.3775 | 10.0.26100.3775 |
| microsoft | windows_server_2019 | < 10.0.17763.7136 | 10.0.17763.7136 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.7136 | 10.0.17763.7136 |
| microsoft | windows_server_2022 | < 10.0.20348.3453 | 10.0.20348.3453 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.3453 | 10.0.20348.3453 |
| microsoft | windows_server_2022_23h2 | < 10.0.25398.1551 | 10.0.25398.1551 |
| microsoft | windows_server_2025 | < 10.0.26100.3775 | 10.0.26100.3775 |
| microsoft | windows_server_2025 | >= 10.0.26100.0 < 10.0.26100.3775 | 10.0.26100.3775 |
| msrc | windows_10_version_1809 | — | — |
| msrc | windows_10_version_21h2 | — | — |
| msrc | windows_10_version_22h2 | — | — |
| msrc | windows_11_version_22h2 | — | — |
| msrc | windows_11_version_23h2 | — | — |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cvhq-cvvf-jw9r: Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally
ghsa_unreviewed·2025-04-08
CVE-2025-26678 [HIGH] CWE-284 GHSA-cvhq-cvvf-jw9r: Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally
Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally.
Microsoft
Windows Defender Application Control Security Feature Bypass Vulnerability
vendor_msrc·2025-04-08·CVSS 8.4
CVE-2025-26678 [HIGH] CWE-284 Windows Defender Application Control Security Feature Bypass Vulnerability
Windows Defender Application Control Security Feature Bypass Vulnerability
Description: Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally.
FAQ: What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploits this vulnerability could bypass Windows Defender Application Control (WDAC) enforcement. This could lead to the ability to run unauthorized applications on target systems.
FAQ: How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by launching any executable that is allowed to launch by a per process rule. Once that executable is validly launched by the correct process, any restrictions
No detection rules found.
No public exploits indexed.
2025-04-08
Published