Two Microsoft Defender failures exploited in real environments raise privileges to SYSTEM and cause DoS urgent patch

Microsoft has confirmed that two crashes in its anti-malware engine have been actively exploited in real environments: one privilege lifting (CVE-2026-41091) qualified with 7.8 on the CVSS scale and one denial of service (CVE-2026-45498) with 4.0 score. The first allows an authorized attacker to climb to SYSTEM privileges by a problem in the resolution of links before access to files, while the second may interrupt the service of the security component. Both errors have been parked in the engine versions indicated by Microsoft, so the update is a priority.

The local nature of the privilege lifting vulnerability means that the attacker needs some degree of initial access to the equipment - for example, a user account or code execution in restricted context - and then take advantage of the failure and take control of the system with complete permissions. That jump to SYSTEM turns any limited access into an integral invasion of endpoint, with the capacity to disable controls, deploy persistence or move laterally within a network.

Microsoft has pointed out that teams with Microsoft Defender disabled are not vulnerable to this particular failure, but disable security solutions is not an acceptable mitigation in productive environments: it leaves systems exposed to known and unknown threats. The company accredited several researchers for the discovery, and has included both failures in its correction channel by automatic engine and definition updates.

If you are an administrator or security officer, check that Microsoft's anti-malware platform is in the versions that correct these faults (e.g., Antimalware Platform 1.1.26040.8 and 4.18.26040.7 as Microsoft reported). You can check official documentation on how to keep Microsoft Defender and customers updated: How to update Microsoft Defender. In addition, the inclusion of these CVE in the CISA catalogue of exploited vulnerabilities requires certain federal entities to remedy in specific time frames; review the catalogue to see the full list and the deadline: CISA KEV (Known Exploited Vulnerabilities).

To check the status on a Windows computer, open the Windows Security application, review the Virus Protection and threats section and check the protection updates; in the About (About) section there is also the antimalware client version number that confirms if you received the correction. In managed environments, it is worth that WSUS, Intune or the patch management solution you use are deploying engine updates correctly and that there are no policies that prevent automatic updating.

In terms of detection and response, check Microsoft Defender records (e.g. events under Microsoft-Windows-Windows Defender / Operational) and your EDR alerts for unusual post-local activities: creating services, starting changes, handling of the antivirus engine or writing to protected directories. Threat hunting should focus on local activity that precedes changes in the security context and in the exploitation of symbolic links or "link following" techniques that take advantage of file access.

Beyond patching, it applies compensatory controls: it reduces local privileges by default, segments networks and limits the implementation capacity of unsigned or unapproved binaries; it uses application restriction policies and less privileged principles to mitigate impact if a local vulnerability is exploited. For organizations with high exposure, consider increasing endpoints telemetry and enabling automated response mechanisms to quickly isolate committed hosts.

The emergence of these vulnerabilities along with others recently added to the CISA catalogue stresses that neither old nor new failures should be ignored: patch hygiene and continuous monitoring remain the most effective defenses. It prioritizes the verification of updates, coordinates with the operations teams the distribution of the patches and documents the verifications to demonstrate compliance with regulatory or contractual requirements.