Actively Exploited Microsoft Defender Flaws Enable SYSTEM Access and Protection Disruption
Active Exploitation · 6 sources · Updated 4mo ago · First seen May 21, 2026
Microsoft disclosed active exploitation of two vulnerabilities in Microsoft Defender, CVE-2026-41091 and CVE-2026-45498, prompting CISA to add both flaws to its Known Exploited Vulnerabilities catalog. CVE-2026-41091 affects the Microsoft Malware Protection Engine and is a local privilege escalation issue tied to improper link resolution in Defender’s scanning logic, allowing an authenticated local attacker to obtain SYSTEM privileges. CVE-2026-45498 affects the Microsoft Defender Antimalware Platform and can cause a denial of service that impairs or crashes Defender protection capabilities.
Microsoft released fixes in Microsoft Malware Protection Engine 1.1.26040.8 and Microsoft Defender Antimalware Platform 4.18.26040.7, with updates delivered through normal Defender mechanisms rather than a separate manual patch. CISA ordered U.S. federal civilian agencies to remediate or discontinue affected products by June 3, 2026 under BOD 22-01. Reporting also linked the exploitation activity to public proof-of-concept releases by researcher Nightmare Eclipse, with Huntress observing attackers using Defender exploit code in the wild.
