CISA Confirms Active Exploitation of Two Microsoft Defender Vulnerabilities
Actively Exploited Microsoft Defender Flaws Allow Privilege Escalation, Evasion
Related Entities(initial)
Products & Tech
CVE Identifiers
MITRE ATT&CK Techniques
Full Report(when first published)
Executive Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that two vulnerabilities in Microsoft Defender are being actively exploited by attackers. On May 20, 2026, CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies apply patches by a specific deadline. The more severe vulnerability, CVE-2026-41091, is a CVSS 7.8 elevation of privilege flaw that allows a local attacker to gain full SYSTEM-level control of a Windows machine. The second, CVE-2026-45498, is a CVSS 4.0 denial-of-service flaw that can be used to crash the Defender antivirus engine, effectively disabling a key security protection. The active exploitation of vulnerabilities in a flagship security product underscores the critical importance of keeping all software, including security tools, up to date.
Vulnerability Details
CVE-2026-41091 - Microsoft Defender Elevation of Privilege Vulnerability
- CVSS Score: 7.8 (High)
- Vulnerability Type: Elevation of Privilege (EoP)
- Impact: This vulnerability allows an attacker who has already gained low-level access to a system (e.g., as a standard user) to exploit a flaw in Microsoft Defender to elevate their privileges to
NT AUTHORITY\SYSTEM. This is the highest level of privilege on a Windows system, giving the attacker complete control to install malware, exfiltrate data, and disable other security controls.
CVE-2026-45498 - Microsoft Defender Denial-of-Service Vulnerability
- CVSS Score: 4.0 (Medium)
- Vulnerability Type: Denial of Service (DoS)
- Impact: An attacker can exploit this flaw to cause the Microsoft Defender Antimalware service to crash or become unresponsive. This does not grant the attacker control of the system, but it creates a critical window of opportunity. With the primary antivirus engine disabled, the attacker can then run their primary payload (e.g., ransomware, spyware) without it being detected or blocked by Defender.
Affected Systems
- Product: Microsoft Defender Antimalware Platform
- Affected Versions: All versions prior to
4.18.26040.7. - Verification: Users can check their version by going to Windows Security > Settings > About.
Exploitation Status
Both vulnerabilities are confirmed by CISA to be under active exploitation. This indicates that attackers have reliable exploits and are using them in real-world attacks. The EoP vulnerability is likely being used in the post-exploitation phase of an attack to gain persistence and full control, while the DoS vulnerability is being used as a defense evasion tactic just before deploying a final payload.
Impact Assessment
The exploitation of vulnerabilities in an endpoint security product is particularly dangerous.
- Loss of Trust: It undermines the trust that users place in their security software. An attacker who can turn the 'guard dog' into an accomplice has a significant advantage.
- Complete System Compromise: The EoP vulnerability (
CVE-2026-41091) leads directly to full system compromise, allowing an attacker to achieve any objective. - Defense Evasion: The DoS vulnerability (
CVE-2026-45498) completely negates the primary purpose of the antivirus software, rendering the system defenseless against subsequent malware attacks.
This scenario is a classic example of an attacker 'disabling the alarm' before robbing the house. The DoS vulnerability is the tool to disable the alarm (Defender), and the EoP vulnerability can be used to gain the keys to every room (SYSTEM privileges).
Cyber Observables — Hunting Hints
The following patterns may help identify systems that have been targeted.
log_sourceWindows System Event LogWinDefend), indicating the service terminated unexpectedly.process_nameMsMpEng.execommand_line_patternwhoami /privDetection Methods
- Version Checking: The most reliable detection method for the vulnerability itself is to check the Microsoft Defender Antimalware Platform version. Use asset inventory tools or scripts to query the version across all endpoints and identify those that are not on
4.18.26040.7or later. - Log Analysis: Ingest Windows System Event Logs into a SIEM and create alerts for events indicating that the
WinDefendservice has crashed or failed to start. This is a direct indicator of the DoS vulnerability being exploited. - Behavioral Analysis: A sophisticated EDR (even Defender for Endpoint's own EDR component) might detect the post-exploitation behavior following the EoP. For example, a low-privilege process spawning a
cmd.exeorpowershell.exewith SYSTEM-level privileges.
Remediation Steps
- Update Immediately: Microsoft Defender typically updates its platform and signatures automatically via Windows Update. However, administrators should verify that these updates are being received and applied promptly. Ensure that Windows Update is configured to receive updates for 'other Microsoft products'.
- Force Update: In enterprise environments, administrators can use tools like WSUS, SCCM/Intune, or PowerShell scripts to force an update of the Defender platform across the fleet.
- Verify Version: After deployment, run queries to confirm that all endpoints have successfully updated to the patched version.
- Enable Tamper Protection: Ensure that Microsoft Defender's Tamper Protection feature is enabled. While it may not prevent the exploit itself, it makes it more difficult for an attacker to manually disable Defender's components after gaining access.
Timeline of Events
Article Updates
May 23, 2026
Microsoft has released emergency security updates for the actively exploited Defender flaws (CVE-2026-41091, CVE-2026-45498), with CISA mandating federal agency patching by June 3, 2026.
Update Sources:
MITRE ATT&CK Mitigations
Update Software
The primary mitigation is to ensure the Microsoft Defender Antimalware Platform is updated to version 4.18.26040.7 or later.
Monitor Windows System Event Logs for unexpected service terminations of the 'WinDefend' service, which can indicate exploitation of the DoS flaw.
Privileged Account Management
Even with the EoP flaw, the initial stages of an attack often rely on compromising a standard user account. Strong credential hygiene and monitoring can prevent this first step.
D3FEND Defensive Countermeasures
For vulnerabilities in a core security product like Microsoft Defender, the Software Update process is absolutely critical. Unlike application vulnerabilities, these flaws undermine the very tools meant to protect the system. Organizations must ensure their device management infrastructure (Windows Update, WSUS, Intune) is correctly configured to push not just signature updates but also platform updates for Defender. Administrators should create compliance reports to verify that the Defender platform version is 4.18.26040.7 or higher across 100% of their Windows fleet. Any machine that fails to update automatically should be investigated immediately, as it may indicate a deeper configuration issue or an existing compromise.
To detect the exploitation of the privilege escalation flaw (CVE-2026-41091), Process Analysis is key. A security monitoring tool (ideally a non-Microsoft EDR, for defense-in-depth) should be configured to detect suspicious parent-child process relationships. For example, if a common user-level process like outlook.exe or chrome.exe spawns a child process that then spawns a command prompt (cmd.exe) running as NT AUTHORITY\SYSTEM, this is a massive red flag for privilege escalation. By analyzing the chain of events and the integrity level changes between processes, defenders can spot the moment an attacker successfully exploits a flaw like this, even if the specific vulnerability is unknown.
To detect the abuse of the denial-of-service flaw (CVE-2026-45498), security teams can employ a form of Session Duration Analysis on their security tool health. The WinDefend service should be running continuously. Any stop/start cycle is suspicious. A SIEM rule can be created to monitor the health of the Defender service. If the service stops (Event ID 7036) and does not restart within a few minutes, or if it stops and starts multiple times in a short period, this should trigger an alert. This indicates that something is interfering with the service's normal operation, which could be an attacker exploiting the DoS vulnerability to create a window for their malware to run undetected. This turns the service's own health status into a tripwire.
Timeline of Events
CISA adds CVE-2026-41091 and CVE-2026-45498 to the Known Exploited Vulnerabilities (KEV) catalog.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.