CVE-2026-50657

Analyzed Analyzed - Analysis Complete

Microsoft Defender Information Disclosure Vulnerability

Publication date: 2026-07-14

Last updated on: 2026-07-22

Assigner: Microsoft Corporation

Description

Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-22

Generated

2026-08-03

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-50657

EUVD

EUVD-2026-44120

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	defender_for_endpoint	From 101.0.0 (inc) to 101.26042.0020 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-359	The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Attack-Flow Graph

Executive Summary

This vulnerability involves Microsoft Defender exposing private personal information to an unauthorized actor. An authorized attacker could exploit it to disclose local information.

Impact Analysis

If exploited, this vulnerability could allow attackers to access your private personal information stored or processed by Microsoft Defender on your local system.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing personal or health information, potentially leading to legal penalties or compliance failures.

Mitigation Strategies

Apply the latest security updates from Microsoft for Defender as soon as they become available to patch the information disclosure vulnerability.

Hi! I’m here to help you understand CVE-2026-50657. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70