CISA warns of exploited Microsoft Defender vulnerabilities affecting Windows systems

CISA has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities catalog, giving federal agencies until June 3, 2026, to apply fixes or mitigations.

The flaws are tracked as CVE-2026-41091 and CVE-2026-45498. One can allow local privilege escalation, while the other can trigger denial-of-service behavior in Defender.

The CISA alert confirms that the vulnerabilities were added to KEV based on evidence of active exploitation. Organizations using Microsoft Defender should verify that their Defender engine and antimalware platform versions have updated successfully.

What Microsoft Defender components are affected

The first flaw, CVE-2026-41091, affects Microsoft Malware Protection Engine version 1.1.26030.3008 and earlier. The engine provides scanning, detection, and remediation capabilities for Microsoft antivirus and antispyware products.

The second flaw, CVE-2026-45498, affects Microsoft Defender Antimalware Platform version 4.18.26030.3011 and earlier. This platform is also used across several Microsoft endpoint security products.

BleepingComputer reported that Microsoft released updated versions to address both issues and said default configurations should keep Defender components updated automatically. Administrators should still verify versions manually, especially in managed or restricted enterprise environments.

CVE	Issue type	Affected component	Impact	Fixed version
CVE-2026-41091	Link following vulnerability	Microsoft Malware Protection Engine	Local privilege escalation	1.1.26040.8 or later
CVE-2026-45498	Denial-of-service vulnerability	Microsoft Defender Antimalware Platform	Defender disruption	4.18.26040.7 or later

CVE-2026-41091 can lead to local privilege escalation

The more severe of the two flaws is CVE-2026-41091, a Microsoft Defender link-following vulnerability. NVD describes it as improper link resolution before file access that allows an authorized attacker to elevate privileges locally.

The flaw requires local access, so it is not a remote unauthenticated attack by itself. However, that does not make it minor. Attackers who already gained a foothold through phishing, stolen credentials, malware, or another exploit could use it to move from limited access to higher privileges.

Successful exploitation can help attackers run actions with elevated permissions, which increases the risk of persistence, defense evasion, credential theft, and lateral movement.

CVE-2026-45498 can disrupt Defender protection

CVE-2026-45498 is a Microsoft Defender denial-of-service vulnerability. NVD lists a high 7.5 score, while Microsoft’s CNA score is 4.0 medium, creating a severity difference between the two records.

The practical risk is that attackers may be able to disrupt Defender behavior on vulnerable systems. In a real attack chain, that can matter because security tooling disruption often happens before malware deployment, credential dumping, or ransomware staging.

Even a temporary Defender disruption can give attackers a better chance to run tools, hide files, or continue post-exploitation activity with less resistance.

CISA set a June 3 remediation deadline

CISA added both Defender vulnerabilities to KEV on May 20, 2026. Federal Civilian Executive Branch agencies must remediate KEV vulnerabilities by the listed deadline under Binding Operational Directive 22-01.

The CISA KEV update gives a June 3, 2026, due date for both Microsoft Defender entries. The required action is to apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

Private organizations should also treat the deadline as a useful risk signal. KEV inclusion means attackers have already used the vulnerabilities in real-world activity, even if CISA does not name the campaigns.

Microsoft released updated Defender versions

Microsoft’s current Defender update channel shows the Malware Protection Engine at version 1.1.26040.8 and the Defender platform at version 4.18.26040.7. These are the versions administrators should look for when validating remediation.

The Microsoft Defender updates page lists the latest security intelligence, engine version, and platform version. This gives administrators a quick way to confirm what Microsoft currently ships through Defender update channels.

Most systems should receive Defender updates automatically. However, enterprise environments may delay updates through WSUS, Intune, Configuration Manager, network restrictions, update rings, maintenance windows, or disconnected security baselines.

Why automatic updates still need verification

Automatic updates reduce risk, but they do not guarantee every endpoint has already received the fixed engine and platform. Some machines may be offline, misconfigured, blocked by policy, or pinned to older enterprise deployment channels.

Administrators should check both the engine version and the antimalware platform version across Windows clients, servers, VDI images, gold images, and systems managed through endpoint security platforms.

• Verify Microsoft Malware Protection Engine version 1.1.26040.8 or later.
• Verify Microsoft Defender Antimalware Platform version 4.18.26040.7 or later.
• Check update compliance in Intune, Configuration Manager, WSUS, or Defender portals.
• Prioritize endpoints that had Defender update failures or stale signatures.
• Review servers and offline images that may not receive updates quickly.
• Investigate any systems where Defender services stopped unexpectedly.

How attackers could use the two flaws together

The two vulnerabilities affect different parts of Defender, but they can support a broader attack chain. An attacker with local access could use privilege escalation to gain more control, then use a Defender disruption path to reduce protection during follow-on activity.

This kind of chaining is common in real intrusions. Attackers rarely rely on one bug from start to finish. They combine phishing, stolen credentials, local flaws, endpoint evasion, scripting tools, and persistence mechanisms to reach their final goal.

BleepingComputer also noted that CVE-2026-41091 is known as RedSun and CVE-2026-45498 is known as UnDefend, based on public researcher disclosures tied to earlier Defender exploit activity.

What administrators should monitor

Security teams should review Defender health signals, service crashes, update failures, suspicious local privilege escalation attempts, and activity that follows Defender disruption. A patched endpoint should still receive log review if it showed abnormal Defender behavior before the update.

Defender service interruptions can happen for legitimate reasons, but repeated failures during suspicious activity deserve immediate investigation. Teams should also check whether attackers attempted to disable updates, tamper with Defender settings, or run tools after protection stopped.

Signal	Why it matters
Defender service crashes or stoppages	May indicate exploitation or tampering attempts.
Failed Defender platform updates	May leave systems vulnerable to known exploited flaws.
Unexpected privilege changes	May show local escalation after initial access.
Suspicious symbolic link activity	May relate to link-following abuse.
Post-disruption malware execution	May show attackers used a Defender gap to run tools.

How to verify Defender versions

Administrators can check Defender versions through Windows Security, PowerShell, enterprise management tools, or Microsoft Defender portals. The goal is to confirm that both the engine and platform versions meet or exceed Microsoft’s fixed builds.

The Microsoft Defender security intelligence page lists the current engine and platform versions. Teams should compare this with local endpoint data and investigate machines that lag behind.

A PowerShell check can help confirm versions on individual Windows systems:

Get-MpComputerStatus | Select-Object AMEngineVersion, AMProductVersion, AntivirusSignatureVersion, AntivirusSignatureLastUpdated

Enterprise teams should run equivalent checks at scale, export noncompliant devices, and push Defender platform updates through their normal endpoint management process.

Recommended response steps

Organizations should move quickly because both vulnerabilities already appear in CISA’s exploited catalog. Even when Defender updates automatically, version validation should become part of the remediation process.

• Confirm all supported Windows systems have the fixed Defender engine and platform versions.
• Force Defender updates on systems that remain behind.
• Review endpoint logs for Defender crashes, update blocking, or tampering attempts.
• Investigate local privilege escalation indicators on systems with suspicious activity.
• Restrict local administrator access and remove unnecessary privileged users.
• Keep Tamper Protection enabled where supported.
• Review attack paths that could give an attacker initial local access.
• Update VDI templates, server images, and offline golden images.

Why security software bugs need fast action

Security tools run with high privileges and sit directly in the attacker’s path. That makes them attractive targets. If attackers can escalate through a security product or disrupt it during an intrusion, they can weaken the system that defenders rely on most.

The two Defender KEV entries show why endpoint security cannot stand alone. Organizations still need least-privilege controls, rapid patching, application control, network detection, identity monitoring, and incident response playbooks.

The safest action is straightforward: verify Defender updates, close the June 3 KEV deadline early, and investigate any endpoint that showed Defender disruption or suspicious local activity before remediation.

FAQ