Security alert: two already exploited zero-day vulnerabilities in Microsoft Defender require immediate patch

Microsoft started to deploy patches this week for two zero-day vulnerabilities in its Microsoft Defender components that are already being exploited in practice, and the news should be taken as a wake-up call: when the engine that examines files runs with privilege lifting and processing malicious content, the protection chain can become an attack vector.

The first failure, recorded as CVE-2026-41091, is a privilege lifting vulnerability in Microsoft Malware Protection Engine (MPE) based on a bad link resolution (link following). In practice, a specially designed file that is scanned by the engine could lead to the attacker's code ending up running with SYSTEM privileges; such failures are especially dangerous because they affect the component in charge of examining files and therefore become a ladder for the attacker.

The second, CVE-2026-45498, impacts the Microsoft Defender Antimalware platform and can allow to cause disservice states (DoS) in non-patched systems. Microsoft has already published corrected versions of the engines: MPE 1.1.26040.8 and platform 4.18.26040.7, but the presence of exploits in nature also led to the inclusion of the U.S. Cybersecurity and Infrastructure Security Agency (CISA) in its catalogue of exploited vulnerabilities (KEV) and ordered the federal agencies to rapid remediation. You can consult the CISA notice at your catalog Known Exploited Vulnerabilities (KEV).

Microsoft's reaction stresses that, under normal conditions, the default configuration of its solutions keeps the signatures and platform up to date automatically; however, in business environments or with managed configurations via WSUS / SCOM / Intune this is not always so. Check that automatic updates are active and confirm installed versions should be the first task. Users can do this from the Windows Security interface by consulting Virus & threat protection → Protection updates, or using PowerShell to audit block: the Get-MpComputerStatus command returns, among others, AMEngineering and AntivirusSignatureVersion, useful indicators to check whether the correction was applied on each computer.

Beyond updating, it is necessary to take operational measures: for administrators, to force the distribution of the update by WSUS, Configuration Manager or Intune and to prioritize servers and equipment with access to sensitive resources; for detection and response teams, to review events and Defense logs in search of service restarts, engine failures or unusual scanning patterns that match access to files with symbolic links / NTFS repairs points. If you detect abnormal behavior in a team after exposure, isolate it from the network and perform a forensic analysis before reproducing it..

The inclusion in the KEV list and the compliance order within time limits set by BOD 22-01 show the seriousness: for the US public sector there is a legal mandate to mitigate these vulnerabilities in a short time, and private organizations must take it as a real and operational risk precedent. You can review the binding directive in the official CISA documentation on the Binding Operational Directive (BOD) 22-01 to understand obligations and deadlines.

Do not underestimate the combination of a high privileges scanning engine and a link treatment failure: is a recipe for climbing and persistence. As best practices, check the update settings, run inventories and remote checks with PowerShell or the management tools you use, immediately park and monitor endpoints engagement indicators. If your organization uses managed versions of System Center or Security Essentials, include these equipment in the update wave because the affected platforms are present in these products.

Finally, remember that these pieces are part of a larger picture: the CISA itself launched recent mitigations for other critical vulnerabilities such as the BitLocker failure known as YellowKey, which shows that the attack surface continues to evolve and requires patching and agile response processes. For Microsoft Defender's update and verification guides you can see official documentation on how to update Microsoft's antivirus in managed environments: Update Microsoft Defender Antivirus.