High

Two newly disclosed zero-day vulnerabilities in Microsoft Defender are being actively exploited in the wild, allowing attackers to gain SYSTEM-level privileges and disrupt endpoint protection on Windows systems. Tracked as CVE-2026-41091 and CVE-2026-45498, the flaws affect core Microsoft Defender components across supported Windows versions and were publicly disclosed on May 19, 2026. Both vulnerabilities have already been confirmed as exploited in real-world attacks, significantly increasing the risk to organizations relying on Defender as their primary security solution.

The first vulnerability, CVE-2026-41091, is an elevation-of-privilege flaw caused by improper link resolution in Microsoft Defender’s scanning process. Attackers with local authenticated access can exploit crafted links or junctions to trick Defender into interacting with attacker-controlled file paths, ultimately achieving SYSTEM privileges. Successful exploitation could allow threat actors to disable security tools, install persistent malware, create privileged accounts, and access sensitive data. Microsoft confirmed active exploitation of the flaw, with affected Malware Protection Engine versions up to 1.1.26030.3008, while patched systems must run version 1.1.26040.8 or later.

The second vulnerability, CVE-2026-45498, is a denial-of-service flaw affecting the Microsoft Defender Antimalware Platform. By exploiting this issue, attackers can crash or impair Defender’s protection capabilities, creating an opportunity for follow-on attacks, stealthy malware deployment, or persistence mechanisms to operate undetected. The last affected Antimalware Platform version is 4.18.26030.3011, with fixes introduced in version 4.18.26040.7. Although systems with Defender disabled may still appear vulnerable during scans because the affected binaries remain installed, Microsoft clarified that disabled environments are generally not exploitable in practice.

The severity of these vulnerabilities prompted the Cybersecurity and Infrastructure Security Agency to add both CVEs to its Known Exploited Vulnerabilities (KEV) Catalog, requiring U.S. federal agencies to remediate affected systems by June 3, 2026, under Binding Operational Directive 22-01. Microsoft stated that no separate manual patch installation is required beyond standard Defender engine and platform updates, which are normally delivered automatically. However, organizations are strongly advised to verify that all endpoints have updated to Defender engine version 1.1.26040.8 and Antimalware Platform version 4.18.26040.7 or later. Given that Microsoft Defender is enabled by default across Windows ecosystems and integrated into multiple Microsoft security products, these actively exploited zero-days represent a highly valuable attack surface for cybercriminals and advanced threat actors alike.