Microsoft Defender: two flaws used in attacks, CVE-2026-41091 and CVE-2026-45498, fixed by automatic update
Two Microsoft Defender flaws were used in attacks: one lets someone already on a PC take full control, the other can stop Defender working. Fixes shipped by automatic update in May. Check Defender's engine is 1.1.26040.8 or later and platform 4.18.26040.7 or later.
Nothing to do on most Windows PCs, since Defender updates itself. To check, open Windows Security, then Settings, then About, and confirm the antimalware client is 4.18.26040.7 or later and the engine is 1.1.26040.8 or later. If not, run Check for updates in Windows Security. Businesses should confirm managed devices have updated.
- Microsoft Defender Malware Protection Enginefixed in 1.1.26040.8 and later
- Microsoft Defender Antimalware Platformfixed in 4.18.26040.7 and later
What’s happening
CISA added two Microsoft Defender flaws to its list of vulnerabilities being used in attacks on 20 May 2026. CVE-2026-41091 is a link-following flaw in the Malware Protection Engine that lets an attacker who already has a foothold on a computer raise their access to SYSTEM, the highest level. CVE-2026-45498 is a denial-of-service flaw in the Defender Antimalware Platform that can crash Defender or stop it working. Microsoft says both were publicly disclosed and exploited, and has fixed them in Malware Protection Engine 1.1.26040.8 and Antimalware Platform 4.18.26040.7. Defender normally updates these components by itself, so most home Windows computers will already have them. Press reports link the flaws to public proof-of-concept exploits called RedSun and UnDefend, released in April 2026, and Huntress responders saw them used together; Microsoft has not confirmed that link. Microsoft's System Center Endpoint Protection and Security Essentials use the same components. Security Essentials on older, unsupported Windows no longer receives updates. Reports disagree on the CVSS score for CVE-2026-45498: 7.5 (NVD) or 4.0. I found no later developments.
- What
- Flaw
- Affects
- Microsoft Defender (Windows antimalware engine and platform)
- Affected
- Microsoft Malware Protection Engine before 1.1.26040.8 (CVE-2026-41091)
Microsoft Defender Antimalware Platform before 4.18.26040.7 (CVE-2026-45498)
System Center Endpoint Protection and Microsoft Security Essentials, which use the same components - Fixed in
- Malware Protection Engine 1.1.26040.8
Defender Antimalware Platform 4.18.26040.7 - Since
- 20 May 2026
- Closed
- 21 May 2026
Timeline
- New fixFixed
Microsoft fixed CVE-2026-41091 in Malware Protection Engine 1.1.26040.8 and CVE-2026-45498 in Defender Antimalware Platform 4.18.26040.7. It said both flaws were publicly disclosed and exploited, and that default settings update the engine and platform automatically.
- CISA added
CISA added CVE-2026-41091 and CVE-2026-45498 to its list of flaws being used in attacks, with a 3 June 2026 deadline for US federal civilian agencies to apply Microsoft's fixes.
- Made publicNo fix yet
A researcher going by Nightmare Eclipse released proof-of-concept exploits for three Defender flaws, BlueHammer, RedSun and UnDefend, on 3 and 15 April 2026. BlueHammer was later fixed as CVE-2026-33825. RedSun and UnDefend were the flaws that later became CVE-2026-41091 and CVE-2026-45498, according to press reports; Microsoft has not formally confirmed this link.
Sources
- Microsoft Defender Link Following Vulnerability, CVE-2026-41091Microsoft Security Response Center · 19 May 2026
- Microsoft Defender Denial of Service Vulnerability, CVE-2026-45498Microsoft Security Response Center · 19 May 2026
- Microsoft Defender vulnerabilities exploited in the wild (CVE-2026-41091, CVE-2026-45498)Help Net Security · 21 May 2026
- Microsoft Defender CVE-2026-41091 and CVE-2026-45498 ExploitedGridinSoft · 21 May 2026