Loading story…
Microsoft resolved a Windows Defender issue that caused quick and full antivirus scans to fail on some Windows 10 and Windows 11 systems, with users reporting msmpeng.exe crashes, WinDefend service timeouts, and 0xc0000005 access violation errors alongside messages stating "Threat service has stopped. Restart it now". Administrators said the failures appeared across multiple devices rather than isolated endpoints, indicating a product-wide fault tied to a recent Defender update or security intelligence release.
Reports from system administrators showed the problem spread widely enough that some customers reinstalled operating systems while troubleshooting. Microsoft confirmed the bug and said it was fixed through Microsoft Defender Antivirus security intelligence update 1.457.236.0 or later, advising affected users to install the latest Defender signature updates through Windows Update; some admins had also circulated a temporary workaround involving removal of dynamic signatures and forcing a signature refresh.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Users and administrators reported starting Tuesday afternoon that Microsoft Defender quick and full scans were failing across multiple Windows 10 and Windows 11 systems, with some environments able to reproduce the issue on multiple devices. Reports included Defender service timeouts, msmpeng.exe crashes, and "Threat service has stopped. Restart it now" messages.
Microsoft confirmed the Defender issue and said it was resolved through Microsoft Defender Antivirus security intelligence update version 1.457.236.0 or later. The company advised affected users to update via Windows Update or enable automatic updates and verify the latest security intelligence was installed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft confirmed that the Windows 11 security update `KB5089549` can fail to install on systems running versions 24H2 and 25H2 when the EFI System Partition has 10 MB or less of free space. Affected devices typically stop during reboot at about 35–36% completion, return error `0x800f0922`, and roll back the update. Microsoft has issued a **Known Issue Rollback** for consumer and unmanaged business devices, while enterprise administrators must use a Group Policy workaround; for persistent cases, the company also published a registry-based mitigation to reduce reserved EFI servicing padding. The same update also addresses a separate problem that had pushed some Windows 11 devices into BitLocker recovery after earlier 2026 updates. The installation issue is significant because Microsoft’s May security advisories also included multiple **Microsoft Defender** vulnerabilities, with `CVE-2026-41091` and `CVE-2026-45498` added by CISA to the **Known Exploited Vulnerabilities** catalog, signaling active exploitation risk. Additional Defender flaws tracked as `CVE-2026-45584` and related advisories were also published by Microsoft and echoed by national cybersecurity agencies, including Canada’s Cyber Centre and HKCERT, which urged organizations to review the bulletins and apply updates. Microsoft said it is developing a permanent fix for the Windows 11 update failure in a future release.
Jun 29, 2026
Microsoft has confirmed a Microsoft Defender Antivirus defect that falsely warns Windows users that virus protection is turned off even when Defender and real-time protection remain enabled and functioning. The recurring “Turn on virus protection” notifications can appear at startup or intermittently afterward, including after they are dismissed, and may bypass Windows notification controls and Do Not Disturb settings. The issue affects supported Windows client and server releases, with reports spanning Windows 10 and Windows 11 versions through 26H1, as well as Windows Server 2025. Microsoft advises users to ignore the erroneous alerts while it develops a correction to be distributed in a future Defender Antivirus update; organizations should nevertheless verify Defender’s actual protection status, as genuine security warnings and social-engineering imitations remain possible.
Sep 1, 2026
A publicly disclosed zero-day dubbed **ShieldBreak** (`CVE-2026-69414`) affects the Microsoft Malware Protection Engine used by Microsoft Defender and allows an authenticated local attacker to escalate from a standard user account to **`NT AUTHORITY\SYSTEM`**. Researchers reported that the flaw bypasses Microsoft's earlier July fix for **RoguePlanet** (`CVE-2026-50656`), and a working proof-of-concept has been released. Microsoft acknowledged the issue and said it is developing a fix, but no patch was available at publication. Reports say the vulnerability impacts modern Windows environments where Microsoft Defender is enabled, including **Windows 11 25H2** and **Windows Server 2025**, with one source also listing **Windows 10** as affected while another said Windows 10 exposure remained unconfirmed. The issue is not remote and requires prior code execution or authenticated local access, but defenders were urged to treat it as high risk because public exploit code lowers the barrier to abuse. Recommended interim actions include restricting local access, monitoring for privilege-escalation behavior and suspicious processes, validating EDR/EPP coverage, enabling protections such as Tamper Protection and Attack Surface Reduction where appropriate, and applying Microsoft's patch as soon as it becomes available.
Aug 25, 2026