{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21537", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-12-30T18:10:54.848Z", "datePublished": "2026-02-10T17:51:32.870Z", "dateUpdated": "2026-05-11T21:25:33.944Z"}, "containers": {"cna": {"title": "Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability", "datePublic": "2026-02-10T16:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:defender_for_endpoint:*:*:*:*:*:*:*:*", "versionStartIncluding": "101.0.0", "versionEndExcluding": "1.0.9.0"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Defender for Endpoint for Linux", "versions": [{"version": "101.0.0", "lessThan": "1.0.9.0", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "lang": "en-US", "type": "CWE", "cweId": "CWE-94"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-05-11T21:25:33.944Z"}, "references": [{"name": "Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21537"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21537", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:55:57.681192Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:45.605Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21537", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:55:57.681192Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:43:10.379Z"}}], "cna": {"title": "Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Defender for Endpoint for Linux", "versions": [{"status": "affected", "version": "101.0.0", "lessThan": "1.0.9.0", "versionType": "custom"}]}], "datePublic": "2026-02-10T16:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21537", "name": "Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:defender_for_endpoint:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.9.0", "versionStartIncluding": "101.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-05-11T18:10:12.883Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21537", "state": "PUBLISHED", "dateUpdated": "2026-05-11T18:10:12.883Z", "dateReserved": "2025-12-30T18:10:54.848Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-02-10T17:51:32.870Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:defender_for_endpoint:-:*:*:*:*:linux:*:*", "matchCriteriaId": "1EFDA019-FE81-4CBC-8B31-E8F9C42272A4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network."}], "id": "CVE-2026-21537", "lastModified": "2026-02-11T21:50:25.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Primary"}]}, "published": "2026-02-10T18:16:35.970", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21537"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "secure@microsoft.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[101.0.0,1.0.9.0)"}}], "product": "defender_for_endpoint", "vendor": "microsoft"}], "analysis": {"en": {"generated_at": "2026-04-15T16:27:57.616631+00:00", "value": {"mitigation_remediation": ["Update Microsoft Defender for Endpoint for Linux to the latest released patch that addresses the code injection issue (see the Microsoft security advisory).", "Limit the Defender for Endpoint service to local traffic only by configuring firewall rules or binding it to localhost, thereby reducing the attack surface exposed over the network.", "Enable monitoring of process creation and system calls on the host to detect abnormal code execution that could indicate exploitation."], "summary": {"action": "Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Microsoft Defender for Endpoint for Linux is affected, but the specific impacted releases or version ranges are not listed in the advisory. Potential victims are Linux systems that have installed the Defender for Endpoint extension and have not applied the latest update from Microsoft.", "description_and_impact": "This vulnerability is a code injection flaw in Microsoft Defender for Endpoint for Linux that allows an attacker to run arbitrary code on an affected host. The flaw arises from improper validation when generating code, giving the attacker the ability to execute unauthorized commands and compromise confidentiality, integrity, and availability of the system. The weakness is identified as CWE\u201194.", "risk_and_exploitability": "The CVSS base score of 8.8 denotes a high severity and indicates that remote code execution is possible. The EPSS score indicates the likelihood of exploitation is very low (< 1%), and the vulnerability does not appear in the CISA KEV catalog at present. Attackers are inferred to need network access to the victim host, likely through adjacent network connections that expose the Defender for Endpoint service. The vulnerability can be exercised by sending specially crafted input that triggers the code generation mechanism, leading to execution in the context of the service."}}}}, "created": "2026-02-10T21:33:45.190312+00:00", "updated": "2026-04-15T17:45:10.813122+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$defender_for_endpoint"]}