{"id":"CVE-2026-122194","kind":"vulnerability","aliases":["CVE-2026-122194"],"related":[],"title":"Microsoft Defender: null pointer flaw lets a network attacker run code","description":"Null pointer dereference in Microsoft Defender allows an unauthorized attacker to execute code over a network.","summary":"Null pointer dereference in Microsoft Defender (NVD lists the Malware Protection Engine) lets an unauthorized attacker execute code over a network. Microsoft's CVSS is 8.8 (AV:N/AC:L/PR:N/UI:R), so user interaction is required. It was published with the November 2026 Patch Tuesday. No exploitation or public PoC found. Affected versions and the fixed version are not yet read from Microsoft's own page.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-defender","other","windows"],"not_affected_if":[],"how_to_check":"Unknown from sources read. Defender's Malware Protection Engine updates automatically; check the engine version in Windows Security > Settings > About, or run Get-MpComputerStatus (AMEngineVersion), and compare with the fixed version in the MSRC advisory once confirmed.","fix":null,"status":"open","published_at":"2026-11-10T19:20:36+00:00","first_seen_at":"2026-11-10T19:25:11+00:00","triaged_at":"2026-11-10T19:27:43+00:00","updated_at":"2026-11-10T21:37:52+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:27:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Defender: null pointer flaw lets a network attacker run code","impact":"high","summary":"A null pointer dereference in Microsoft Defender lets an unauthorized attacker execute code over a network. The sources give a CVSS score of 8.8 and no further detail.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-defender","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs code on the machine over the network","analyst_note":"Check the Microsoft Security Response Center advisory for affected Defender versions, the fixed platform or engine version, and whether default configurations are exposed.","how_to_check":"- unknown","plain_action":"Make sure Microsoft Defender is set to update automatically, and install any update Microsoft releases for it.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":4486,"output_tokens":381,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for affected Defender versions, the fixed platform or engine version, and whether default configurations are exposed.","search":"'-122194':14A,17A '-2026':13A,16A '2026':65B '8.8':48B 'affect':74B 'allow':95C 'attack':9A,38B,98C 'av':49B 'code':11A,40B,101C 'cve':12A,15A 'cvss':46B 'defend':2A,20B,28B,94C 'derefer':25B,91C 'engin':34B 'execut':39B,100C 'exploit':69B 'fix':78B 'flaw':5A 'found':73B 'interact':56B 'l/pr':51B 'let':6A,35B 'list':30B 'malwar':32B 'microsoft':1A,19B,27B,44B,85B,93C 'microsoft-defend':18B 'n/ac':50B 'n/ui':52B 'network':8A,43B,104C 'novemb':64B 'null':3A,23B,89C 'nvd':29B 'page':88B 'patch':66B 'poc':72B 'pointer':4A,24B,90C 'protect':33B 'public':71B 'publish':61B 'r':53B 'read':83B 'requir':58B 'run':10A 'tuesday':67B 'unauthor':37B,97C 'user':55B 'version':75B,79B 'window':22B 'yet':82B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Make sure Microsoft Defender is set to update automatically, and install any update Microsoft releases for it.","pkeys":[],"ptokens":[],"labels":["high","microsoftdefender","other","windows"],"campaign_type":null,"search_a":"'-122194':14A,17A '-2026':13A,16A 'attack':9A 'code':11A 'cve':12A,15A 'defend':2A 'flaw':5A 'let':6A 'microsoft':1A 'network':8A 'null':3A 'pointer':4A 'run':10A","search_b":"'2026':65B '8.8':48B 'affect':74B 'attack':38B 'av':49B 'code':40B 'cvss':46B 'defend':20B,28B 'derefer':25B 'engin':34B 'execut':39B 'exploit':69B 'fix':78B 'found':73B 'interact':56B 'l/pr':51B 'let':35B 'list':30B 'malwar':32B 'microsoft':19B,27B,44B,85B 'microsoft-defend':18B 'n/ac':50B 'n/ui':52B 'network':43B 'novemb':64B 'null':23B 'nvd':29B 'page':88B 'patch':66B 'poc':72B 'pointer':24B 'protect':33B 'public':71B 'publish':61B 'r':53B 'read':83B 'requir':58B 'tuesday':67B 'unauthor':37B 'user':55B 'version':75B,79B 'window':22B 'yet':82B","search_c":"'allow':95C 'attack':98C 'code':101C 'defend':94C 'derefer':91C 'execut':100C 'microsoft':93C 'network':104C 'null':89C 'pointer':90C 'unauthor':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122194","severity":null,"published_at":"2026-11-10T19:20:36+00:00","modified_at":"2026-11-10T19:20:36+00:00","first_seen_at":"2026-11-10T19:25:11+00:00","fetched_at":"2026-11-10T19:25:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122194:2826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122194","severity":null,"published_at":"2026-11-10T21:37:52+00:00","modified_at":"2026-11-10T21:37:52+00:00","first_seen_at":"2026-11-10T21:37:52+00:00","fetched_at":"2026-11-10T21:37:52+00:00","note":"MSRC page and API returned no content to web-cli (JS-only); only NVD (CNA Microsoft record) read. Affected versions and fixed engine version unknown; nothing verified. Settle by reading the MSRC update guide entry in a browser.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-122194"]}],"documents":[{"id":118947,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122194","title":"NVD CVE-2026-122194 (CNA: Microsoft)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}