CVE-2026-21537CWE-94

Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability

High · published February 10, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

⚡ A crafty attacker can execute code over an adjacent network with Microsoft Defender for Linux! 🚨 Think of it like a restaurant where a waiter can bring food from the wrong kitchen — if they’re not checking the orders, they might end up serving a dish that was never even prepared for that table. Here, the improper control allows malicious code to sneak in without any checks! An attacker could potentially run arbitrary code, leading to unauthorized access and control over the system. This means they could compromise sensitive data, disrupt operations, or even pivot to other systems on the network, which could be absolutely devastating!

Put simply

Think of it like a restaurant where a waiter can bring food from the wrong kitchen — if they’re not checking the orders, they might end up serving a dish that was never even prepared for that table. Here, the improper control allows malicious code to sneak in without any checks! This code injection vulnerability in Microsoft Defender for Linux allows unauthorized attackers to manipulate the code execution process, exploiting a flaw in how code generation is controlled.

What to do

An attacker could potentially run arbitrary code, leading to unauthorized access and control over the system. This means they could compromise sensitive data, disrupt operations, or even pivot to other systems on the network, which could be absolutely devastating! To safeguard your systems, update Microsoft Defender for Linux to the latest version immediately. Additionally, implement network segmentation to minimize exposure to adjacent networks and review your security policies to ensure all components are up to date. 🛡️ You've got this! By following these steps, you'll bolster your defenses and keep your environment secure! 💪✨

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00532 · 44.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-02-10T17:51Z
EPSS history
Timeline
  • 10 FEB 17:51Z
    Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability
    cvelistv5