CVE-2026-50658 Overview
CVE-2026-50658 is a time-of-check time-of-use (TOCTOU) race condition in Microsoft Defender. An authorized local attacker can exploit the flaw to elevate privileges on an affected system. The weakness is classified under CWE-367, which covers race conditions between validation and use of a resource.
Successful exploitation grants high impact to confidentiality, integrity, and availability. Attack complexity is high because the attacker must win a narrow timing window, and low-level privileges on the target are required. Microsoft published the advisory on 2026-07-14 with updated details on 2026-07-15.
Critical Impact
A local, authenticated attacker who wins the race between Defender's check and use of a protected resource can achieve privilege escalation with full impact to system confidentiality, integrity, and availability.
Affected Products
- Microsoft Defender (see the Microsoft Security Advisory CVE-2026-50658 for specific affected builds)
Discovery Timeline
- 2026-07-14 - CVE-2026-50658 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-50658
Vulnerability Analysis
The vulnerability is a TOCTOU race condition inside Microsoft Defender. Defender validates the state of a resource at one point in time and later uses that resource without re-checking. An attacker with local access can modify the resource between the check and the use, causing Defender to operate on attacker-controlled data.
Because Defender runs with elevated privileges, redirecting its operations to attacker-controlled targets can produce privilege escalation. The Microsoft advisory does not disclose the specific resource path or system call sequence involved. Exploitation requires an authenticated local session and precise timing.
Root Cause
The root cause is non-atomic handling of a security-relevant resource in Microsoft Defender, tracked under CWE-367. Defender performs a validity or trust check on a file, symlink, or handle, then acts on that same identifier without holding an exclusive lock or re-validating state. An unprivileged process on the same host can swap the underlying object during the window between the two operations.
Attack Vector
The attack vector is local. An attacker must already have low-level privileges on the endpoint, for example through a standard user account or a compromised low-privilege process. The attacker races Defender by rapidly modifying a filesystem object, junction, or symbolic link that Defender is inspecting or operating on. Winning the race causes Defender's privileged operation to affect an object the attacker chose, yielding code execution or file manipulation in a higher-privileged context.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.193%.
See the Microsoft Security Advisory CVE-2026-50658 for technical details.
Detection Methods for CVE-2026-50658
Indicators of Compromise
- Unexpected creation, deletion, or renaming of filesystem junctions, symbolic links, or hard links inside directories that Microsoft Defender scans or quarantines.
- Low-privilege processes rapidly opening and closing handles to the same path targeted by an MsMpEng.exe operation.
- Files or directories owned by SYSTEM appearing in locations writable by standard users after Defender activity.
Detection Strategies
- Alert on standard-user processes that spawn tight loops of CreateFile, SetFileInformation, or reparse-point manipulation adjacent to Defender scan targets.
- Correlate Microsoft Defender operational events with Sysmon file-create and file-delete events on the same paths within short time windows.
- Hunt for privilege escalation chains that begin with a non-admin process and end with a SYSTEM-context write or process creation initiated by a Defender component.
Monitoring Recommendations
- Ingest Microsoft Defender operational logs and Windows Security event logs into a centralized SIEM for cross-source correlation.
- Monitor process lineage for MsMpEng.exe and related Defender binaries to catch anomalous child processes or file operations.
- Track patch level of Microsoft Defender platform and definition versions across the fleet to identify unpatched endpoints.
How to Mitigate CVE-2026-50658
Immediate Actions Required
- Apply the Microsoft Defender platform update referenced in the Microsoft Security Advisory CVE-2026-50658.
- Verify that Microsoft Defender is receiving automatic platform and engine updates on all managed endpoints.
- Restrict interactive and remote logon rights so that only trusted accounts hold local sessions on servers and privileged workstations.
Patch Information
Microsoft addressed CVE-2026-50658 through a Defender platform update. Refer to the Microsoft Security Advisory CVE-2026-50658 for the fixed platform version and rollout details. Because Defender platform updates typically deploy automatically through Microsoft Update, confirm the update channel is functional and the reported platform version is at or above the fixed build.
Workarounds
- No vendor-supplied workaround is documented. Reduce risk by limiting local logon rights and enforcing least privilege on end-user accounts.
- Enforce application control policies such as Windows Defender Application Control to block untrusted binaries that could stage the race condition.
- Monitor and alert on suspicious filesystem manipulation adjacent to Defender scan paths until patching is confirmed across the environment.
# Confirm the installed Microsoft Defender platform and engine versions on Windows
Get-MpComputerStatus | Select-Object AMProductVersion, AMEngineVersion, AntivirusSignatureVersion, NISEngineVersion
# Force a signature and platform update
Update-MpSignature
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
