{"id":"defender-redsun-undefend-exploited-may-2026","category":"patch","status":"closed","title":"Microsoft Defender: two flaws used in attacks, CVE-2026-41091 and CVE-2026-45498, fixed by automatic update","tldr":"Two Microsoft Defender flaws were used in attacks: one lets someone already on a PC take full control, the other can stop Defender working. Fixes shipped by automatic update in May. Check Defender's engine is 1.1.26040.8 or later and platform 4.18.26040.7 or later.","summary":"CISA added two Microsoft Defender flaws to its list of vulnerabilities being used in attacks on 20 May 2026. CVE-2026-41091 is a link-following flaw in the Malware Protection Engine that lets an attacker who already has a foothold on a computer raise their access to SYSTEM, the highest level. CVE-2026-45498 is a denial-of-service flaw in the Defender Antimalware Platform that can crash Defender or stop it working. Microsoft says both were publicly disclosed and exploited, and has fixed them in Malware Protection Engine 1.1.26040.8 and Antimalware Platform 4.18.26040.7. Defender normally updates these components by itself, so most home Windows computers will already have them. Press reports link the flaws to public proof-of-concept exploits called RedSun and UnDefend, released in April 2026, and Huntress responders saw them used together; Microsoft has not confirmed that link. Microsoft's System Center Endpoint Protection and Security Essentials use the same components. Security Essentials on older, unsupported Windows no longer receives updates. Reports disagree on the CVSS score for CVE-2026-45498: 7.5 (NVD) or 4.0. I found no later developments.","action":"Nothing to do on most Windows PCs, since Defender updates itself. To check, open Windows Security, then Settings, then About, and confirm the antimalware client is 4.18.26040.7 or later and the engine is 1.1.26040.8 or later. If not, run Check for updates in Windows Security. Businesses should confirm managed devices have updated.","product":"Microsoft Defender (Windows antimalware engine and platform)","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-41091","CVE-2026-45498"],"tags":["microsoft","defender","windows","zero-day","privilege-escalation","denial-of-service","cisa-kev","redsun","undefend"],"affected":["Microsoft Malware Protection Engine before 1.1.26040.8 (CVE-2026-41091)","Microsoft Defender Antimalware Platform before 4.18.26040.7 (CVE-2026-45498)","System Center Endpoint Protection and Microsoft Security Essentials, which use the same components"],"fixed":["Malware Protection Engine 1.1.26040.8","Defender Antimalware Platform 4.18.26040.7"],"matches":[{"platform":"windows","app":"Microsoft Defender Malware Protection Engine","bundle":"","fixed":"1.1.26040.8"},{"platform":"windows","app":"Microsoft Defender Antimalware Platform","bundle":"","fixed":"4.18.26040.7"}],"sources":[{"kind":"advisory","title":"Microsoft Defender Link Following Vulnerability, CVE-2026-41091","url":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091","by":"Microsoft Security Response Center","date":"2026-05-19"},{"kind":"advisory","title":"Microsoft Defender Denial of Service Vulnerability, CVE-2026-45498","url":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498","by":"Microsoft Security Response Center","date":"2026-05-19"},{"kind":"news","title":"Microsoft Defender vulnerabilities exploited in the wild (CVE-2026-41091, CVE-2026-45498)","url":"https://www.helpnetsecurity.com/2026/05/21/microsoft-defender-vulnerabilities-cve-2026-41091-cve-2026-45498/","by":"Help Net Security","date":"2026-05-21"},{"kind":"news","title":"Microsoft Defender CVE-2026-41091 and CVE-2026-45498 Exploited","url":"https://blog.gridinsoft.com/microsoft-defender-cve-2026-41091-cve-2026-45498-exploited/","by":"GridinSoft","date":"2026-05-21"}],"started":"2026-05-20","closed":"2026-05-21","created":"2026-11-03T21:45:03.865Z","updated":"2026-11-03T21:45:03.865Z","cve_notes":[{"cve":"CVE-2026-41091","name":"Link-following privilege escalation in Defender engine","what":"A link-following flaw in Microsoft Defender's Malware Protection Engine, which resolves file links improperly, that lets an attacker already on a computer raise their access to SYSTEM.","severity":"high","cvss":7.8},{"cve":"CVE-2026-45498","name":"Denial of service in Defender Antimalware Platform","what":"A flaw in the Defender Antimalware Platform that an attacker can use to crash Defender or stop it working, leaving the computer less protected.","severity":"high","cvss":7.5}],"timeline":[{"at":"2026-05-21","added":"2026-11-03T21:41:32.717Z","kind":"new-fix","text":"Microsoft fixed CVE-2026-41091 in Malware Protection Engine 1.1.26040.8 and CVE-2026-45498 in Defender Antimalware Platform 4.18.26040.7. It said both flaws were publicly disclosed and exploited, and that default settings update the engine and platform automatically.","url":"https://www.helpnetsecurity.com/2026/05/21/microsoft-defender-vulnerabilities-cve-2026-41091-cve-2026-45498/","by":"Help Net Security","patch":"patched"},{"at":"2026-05-20","added":"2026-11-03T21:41:32.717Z","kind":"cisa-added","text":"CISA added CVE-2026-41091 and CVE-2026-45498 to its list of flaws being used in attacks, with a 3 June 2026 deadline for US federal civilian agencies to apply Microsoft's fixes.","url":"https://www.helpnetsecurity.com/2026/05/21/microsoft-defender-vulnerabilities-cve-2026-41091-cve-2026-45498/","by":"Help Net Security","patch":null},{"at":"2026-04-15","added":"2026-11-03T21:41:32.717Z","kind":"disclosed","text":"A researcher going by Nightmare Eclipse released proof-of-concept exploits for three Defender flaws, BlueHammer, RedSun and UnDefend, on 3 and 15 April 2026. BlueHammer was later fixed as CVE-2026-33825. RedSun and UnDefend were the flaws that later became CVE-2026-41091 and CVE-2026-45498, according to press reports; Microsoft has not formally confirmed this link.","url":"https://www.helpnetsecurity.com/2026/05/21/microsoft-defender-vulnerabilities-cve-2026-41091-cve-2026-45498/","by":"Help Net Security","patch":"none"}],"url":"https://hard.fyi/live/defender-redsun-undefend-exploited-may-2026/","json":"https://hard.fyi/api/live?id=defender-redsun-undefend-exploited-may-2026"}