Loading story…
Microsoft has confirmed a Microsoft Defender Antivirus defect that falsely warns Windows users that virus protection is turned off even when Defender and real-time protection remain enabled and functioning. The recurring “Turn on virus protection” notifications can appear at startup or intermittently afterward, including after they are dismissed, and may bypass Windows notification controls and Do Not Disturb settings.
The issue affects supported Windows client and server releases, with reports spanning Windows 10 and Windows 11 versions through 26H1, as well as Windows Server 2025. Microsoft advises users to ignore the erroneous alerts while it develops a correction to be distributed in a future Defender Antivirus update; organizations should nevertheless verify Defender’s actual protection status, as genuine security warnings and social-engineering imitations remain possible.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
False “Turn on virus protection” notifications were reportedly first observed in early August, with reports increasing in the days before the initial coverage.
The erroneous Microsoft Defender Antivirus notifications had affected Windows Insider Release Preview Channel users since June, despite Defender continuing to operate normally.
Microsoft advised affected users to disregard the incorrect notifications and said it is developing a correction for delivery through a future Microsoft Defender Antivirus update; no responsible update version or release date was specified.
Microsoft acknowledged that recent Defender Antivirus updates can incorrectly report that antivirus protection is turned off even while Defender and its protection settings remain active. The issue affects supported Windows client and server systems, and the alerts can recur at startup or during normal use despite notification settings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcewindowslatest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft resolved a Windows Defender issue that caused quick and full antivirus scans to fail on some Windows 10 and Windows 11 systems, with users reporting `msmpeng.exe` crashes, WinDefend service timeouts, and **0xc0000005** access violation errors alongside messages stating **"Threat service has stopped. Restart it now"**. Administrators said the failures appeared across multiple devices rather than isolated endpoints, indicating a product-wide fault tied to a recent Defender update or security intelligence release. Reports from system administrators showed the problem spread widely enough that some customers reinstalled operating systems while troubleshooting. Microsoft confirmed the bug and said it was fixed through Microsoft Defender Antivirus security intelligence update **`1.457.236.0`** or later, advising affected users to install the latest Defender signature updates through Windows Update; some admins had also circulated a temporary workaround involving removal of dynamic signatures and forcing a signature refresh.
Aug 20, 2026
A faulty Microsoft Defender signature update released on April 30 incorrectly detected legitimate DigiCert root certificates as `Trojan:Win32/Cerdigent.A!dha`, triggering alerts across Windows environments and, in some cases, quarantining or removing trusted roots from stores such as **AuthRoot**. The flagged thumbprints were tied to valid DigiCert trust anchors, including **DigiCert Assured ID Root CA** and **DigiCert Trusted Root G4**, causing administrators and SOC teams to suspect compromise and disrupting certificate trust relationships used for TLS validation and code signing. Microsoft later acknowledged the detections were erroneous and remediated the issue with updated Defender security intelligence, including version `1.449.430.0` or later. Reporting indicates the overly broad detection logic may have stemmed from Microsoft’s response to a separate DigiCert code-signing certificate incident linked to abuse such as the **Zhong Stealer** campaign, but the certificates flagged in this case were legitimate and not revoked. The false positive prompted some organizations to take unnecessary recovery actions, including system rebuilds, underscoring the operational risk of automated detections that affect root certificate trust stores.
Jun 29, 2026
Microsoft confirmed that the Windows 11 security update `KB5089549` can fail to install on systems running versions 24H2 and 25H2 when the EFI System Partition has 10 MB or less of free space. Affected devices typically stop during reboot at about 35–36% completion, return error `0x800f0922`, and roll back the update. Microsoft has issued a **Known Issue Rollback** for consumer and unmanaged business devices, while enterprise administrators must use a Group Policy workaround; for persistent cases, the company also published a registry-based mitigation to reduce reserved EFI servicing padding. The same update also addresses a separate problem that had pushed some Windows 11 devices into BitLocker recovery after earlier 2026 updates. The installation issue is significant because Microsoft’s May security advisories also included multiple **Microsoft Defender** vulnerabilities, with `CVE-2026-41091` and `CVE-2026-45498` added by CISA to the **Known Exploited Vulnerabilities** catalog, signaling active exploitation risk. Additional Defender flaws tracked as `CVE-2026-45584` and related advisories were also published by Microsoft and echoed by national cybersecurity agencies, including Canada’s Cyber Centre and HKCERT, which urged organizations to review the bulletins and apply updates. Microsoft said it is developing a permanent fix for the Windows 11 update failure in a future release.
Jun 29, 2026