Loading story…
Microsoft resolved a Windows Security defect that falsely reported Microsoft Defender Antivirus as disabled even though the service and its protections were functioning normally. The issue affected supported Windows 10, Windows 11, and Windows Server systems, first surfacing among Windows Insiders in June before appearing more broadly after a Defender update in early August.
The misleading alerts could appear at startup and intermittently afterward, could not be permanently dismissed, and persisted despite notification-setting changes. Microsoft released the correction in Defender Antivirus version 4.18.26080.4 on September 17; it installs automatically unless mandatory security updates have been blocked through Registry or Group Policy settings.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft released Microsoft Defender Antivirus version 4.18.26080.4 to resolve the erroneous disabled-antivirus notifications on supported Windows client and server systems.
Microsoft acknowledged the issue causing Windows Security to incorrectly report that Microsoft Defender Antivirus was disabled while it continued functioning correctly.
Users began reporting notifications that Microsoft Defender Antivirus was turned off even though protection remained active. The issue affected Windows 11, Windows 10, and Windows Server following recent Defender updates.
Incorrect Windows Security notifications claiming Microsoft Defender Antivirus was turned off were observed in the Windows Insider program as early as June.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has confirmed a Microsoft Defender Antivirus defect that falsely warns Windows users that virus protection is turned off even when Defender and real-time protection remain enabled and functioning. The recurring “Turn on virus protection” notifications can appear at startup or intermittently afterward, including after they are dismissed, and may bypass Windows notification controls and Do Not Disturb settings. The issue affects supported Windows client and server releases, with reports spanning Windows 10 and Windows 11 versions through 26H1, as well as Windows Server 2025. Microsoft advises users to ignore the erroneous alerts while it develops a correction to be distributed in a future Defender Antivirus update; organizations should nevertheless verify Defender’s actual protection status, as genuine security warnings and social-engineering imitations remain possible.
Sep 1, 2026
Microsoft resolved a Windows Defender issue that caused quick and full antivirus scans to fail on some Windows 10 and Windows 11 systems, with users reporting `msmpeng.exe` crashes, WinDefend service timeouts, and **0xc0000005** access violation errors alongside messages stating **"Threat service has stopped. Restart it now"**. Administrators said the failures appeared across multiple devices rather than isolated endpoints, indicating a product-wide fault tied to a recent Defender update or security intelligence release. Reports from system administrators showed the problem spread widely enough that some customers reinstalled operating systems while troubleshooting. Microsoft confirmed the bug and said it was fixed through Microsoft Defender Antivirus security intelligence update **`1.457.236.0`** or later, advising affected users to install the latest Defender signature updates through Windows Update; some admins had also circulated a temporary workaround involving removal of dynamic signatures and forcing a signature refresh.
Aug 20, 2026
A faulty Microsoft Defender signature update released on April 30 incorrectly detected legitimate DigiCert root certificates as `Trojan:Win32/Cerdigent.A!dha`, triggering alerts across Windows environments and, in some cases, quarantining or removing trusted roots from stores such as **AuthRoot**. The flagged thumbprints were tied to valid DigiCert trust anchors, including **DigiCert Assured ID Root CA** and **DigiCert Trusted Root G4**, causing administrators and SOC teams to suspect compromise and disrupting certificate trust relationships used for TLS validation and code signing. Microsoft later acknowledged the detections were erroneous and remediated the issue with updated Defender security intelligence, including version `1.449.430.0` or later. Reporting indicates the overly broad detection logic may have stemmed from Microsoft’s response to a separate DigiCert code-signing certificate incident linked to abuse such as the **Zhong Stealer** campaign, but the certificates flagged in this case were legitimate and not revoked. The false positive prompted some organizations to take unnecessary recovery actions, including system rebuilds, underscoring the operational risk of automated detections that affect root certificate trust stores.
Jun 29, 2026