Microsoft Warns of New Defender Zero‑Days Exploited in Active Attacks

Overview Microsoft has confirmed that two zero‑day vulnerabilities in Microsoft Defender for Endpoint are being actively exploited in the wild. The company began rolling out emergency patches on May 21, 2026, addressing flaws that affect both the Malware Protection Engine and the Defender Antimalware Platform — critical components of Windows’ built‑in security stack.

These vulnerabilities, tracked as CVE‑2026‑41091 and CVE‑2026‑45498, highlight how attackers continue to target endpoint protection systems themselves to gain elevated privileges or disrupt defenses.

CVE‑2026‑41091 — Privilege Escalation in Malware Protection Engine

The first flaw resides in Microsoft Malware Protection Engine 1.1.26030.3008 and earlier, which powers scanning, detection, and cleaning for Defender and other Microsoft security products.

• Root cause: Improper link resolution before file access (a link‑following weakness).
• Impact: Exploitation grants attackers SYSTEM‑level privileges, enabling full control of the affected device.
• Fix: Update to Malware Protection Engine version 1.1.26040.8 or newer.

This vulnerability is particularly dangerous because it targets the very engine responsible for malware removal — turning a defensive tool into an attack vector.

CVE‑2026‑45498 — Denial‑of‑Service in Defender Antimalware Platform

The second flaw affects Microsoft Defender Antimalware Platform 4.18.26030.3011 and earlier, used by System Center Endpoint Protection, Security Essentials, and Defender for Endpoint.

• Impact: Attackers can trigger denial‑of‑service (DoS) conditions, rendering Windows devices temporarily unprotected.
• Fix: Update to Defender Antimalware Platform version 4.18.26040.7 or newer.

While less severe than privilege escalation, DoS attacks against endpoint protection can create blind spots that allow secondary payloads to execute undetected.

Automatic Updates and Verification

Microsoft reassured customers that no manual action is typically required, as Defender’s default configuration automatically updates both malware definitions and platform versions.

To confirm patch installation:

1. Open Windows Security → Virus & Threat Protection.
2. Select Protection Updates → Check for updates.
3. Navigate to Settings → About.
4. Verify that the Antimalware ClientVersion matches or exceeds the patched version numbers.

This simple verification ensures that endpoints are running the latest protection engine and are no longer vulnerable to exploitation.

CISA Directive and Federal Response

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Under Binding Operational Directive (BOD) 22‑01, all Federal Civilian Executive Branch (FCEB) agencies must secure their Windows endpoints by June 3, 2026.

CISA emphasized that these types of flaws are frequent attack vectors and pose significant risks to government networks. Agencies are instructed to:

• Apply mitigations per Microsoft’s guidance.
• Follow BOD 22‑01 cloud‑service security requirements.
• Discontinue use of affected products if mitigations are unavailable.

Technical Context

These zero‑days demonstrate how Defender’s deep integration with Windows can make it a high‑value target. Attackers exploiting link‑handling or privilege boundaries can escalate privileges or disable protection mechanisms, undermining endpoint resilience.

The vulnerabilities also underscore the importance of continuous update validation — even when automatic patching is enabled — to ensure that enterprise environments remain protected against evolving threats.

Final Thoughts

Microsoft’s swift response to these Defender zero‑days reinforces the value of automated security maintenance and coordinated vulnerability disclosure. For enterprises, this incident serves as a reminder that endpoint protection software itself must be monitored and patched just like any other critical system component.

Organizations should regularly audit Defender configurations, verify update compliance, and integrate threat‑intelligence monitoring to detect exploitation attempts early.