CVE-2026-50657

Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability

Published Jul 14, 2026 CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Description

Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.

Analysis

Technical impact

An authorized user of Microsoft Defender for Endpoint on macOS can locally access sensitive personal data that should remain private. The vulnerability is a local information disclosure, classified as CWE-359, allowing an attacker with legitimate Defender privileges to reveal confidential information.

Affected Systems

Microsoft Defender for Endpoint for Mac from Microsoft. No specific affected product versions are listed in the available data.

Risk and Exploitability

The CVSS score of 4.7 indicates a moderate severity level, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. Because the attack requires an authorized local user with Defender access, the likely attack vector is local exploitation rather than network-based.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Microsoft Defender for Endpoint for Mac

affected

Version	Status	Constraints
`101.0.0`	affected	< 101.26042.0020

Configuration 1 [-]

cpe:2.3:a:microsoft:defender_for_endpoint:*:*:*:*:*:macos:*:*

No data.

Vendor Product Versions

Microsoft

Defender For Endpoint

Version	Status	Scheme	Platform
`[101.0.0,101.26042.0020)`	affected	semver	['macos']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install the latest Microsoft Defender for Endpoint for Mac update that contains the fix.
Limit local user permissions so that only trusted administrators can run Defender and access its logs.
Enable macOS security features, such as Gatekeeper and the firewall, to reduce the opportunity for local attackers to exploit the application.

Generated by OpenCVE AI on July 31, 2026 at 07:23 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.400% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50657

History

Jul 15, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 5:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.
Title		Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability
First Time appeared		Microsoft Microsoft defender For Endpoint
Weaknesses		CWE-359
CPEs		cpe:2.3:a:microsoft:defender_for_endpoint::::::macos::*
Vendors & Products		Microsoft Microsoft defender For Endpoint
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50657
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}`