# Microsoft Defender Under Active Attack: Two Critical Vulnerabilities Demand Immediate Patching
## The Threat
Microsoft has confirmed that two vulnerabilities in Windows Defender are being actively exploited by attackers in the wild. The most severe, CVE-2026-41091, allows attackers to escalate privileges to SYSTEM level on a compromised machine—a key stepping stone toward complete takeover. The flaw stems from improper link resolution before file access, a classic pattern vulnerability where attackers can manipulate symbolic links to bypass security controls and gain elevated access.
The second vulnerability, CVE-2026-45498, is a denial-of-service flaw that can disable Defender's protection mechanism entirely, leaving systems exposed. While less severe on the CVSS scale, a DoS against antimalware software is particularly dangerous because it silences the very tool designed to detect subsequent attacks.
The fact that both vulnerabilities are currently being weaponized in real-world attacks underscores the urgency. Threat actors have already moved from theoretical exploitation to active compromise, meaning vulnerable systems are likely under active attack right now. Windows Defender is installed on billions of endpoints worldwide, making this a sprawling vulnerability that impacts enterprises, government agencies, and individual users alike.
## Severity and Impact
| Vulnerability | CVE | CVSS Score | Type | Attack Vector | Attack Complexity | Authentication Required | Status |
|---|---|---|---|---|---|---|---|
| Link Following Privilege Escalation | CVE-2026-41091 | 7.8 | Improper Link Resolution | Local | Low | Yes (Authorized User) | Actively Exploited |
| Denial of Service | CVE-2026-45498 | 4.0 | Denial of Service | Network/Local | Low | No | Actively Exploited |
Both vulnerabilities carry CISA's "Known Exploited Vulnerabilities" designation, triggering mandatory patching deadlines for U.S. Federal Civilian Executive Branch agencies by June 3, 2026.
## Affected Products
Microsoft Defender Antimalware Platform:
Windows Operating Systems:
Additional Platforms:
Notably, systems with Microsoft Defender explicitly disabled are not susceptible to these flaws.
## Mitigations
Immediate Actions:
1. Install Updates: Patches are automatically deployed to most systems, but verification is critical.
- Open Windows Security
- Navigate to *Virus & threat protection* > *Protection Updates*
- Click "Check for updates"
- In *Settings* > *About*, verify Antimalware ClientVersion matches 1.1.26040.8 or 4.18.26040.7
2. Verify Defender Status:
- Ensure Microsoft Defender is active and running
- Check that real-time protection is enabled
- Confirm recent definition updates
3. Network Segmentation: Isolate critical systems and limit lateral movement capabilities while patches are being deployed across your environment.
4. Monitor for Exploitation Signs:
- Watch for unexpected SYSTEM-level process creation
- Monitor for disabled antimalware services
- Track failed Defender update attempts
- Review Windows Security event logs for anomalies
5. Federal Agencies: Confirm patching completion by the June 3, 2026 CISA deadline. Non-compliance may trigger escalation under federal cybersecurity requirements.
Workarounds (Temporary):
If immediate patching is not feasible, disable access to symbolic link operations and restrict Defender API access through Group Policy pending full updates.
## References
---
## HackWire Analysis
What makes this vulnerability wave particularly concerning is the timing and trajectory: Microsoft disclosed *three* actively exploited vulnerabilities within a single week—the Defender flaws plus CVE-2026-42897, an Exchange Server XSS vulnerability. More alarming still, CISA simultaneously resurfaced four ancient vulnerabilities from 2008-2010 (IE use-after-free flaws, DirectX buffer overflow, Windows Server RPC vulnerability) by adding them to the KEV catalog. This isn't routine vulnerability management; it signals a strategic shift in threat actor tactics.
The Defender privilege escalation is particularly insidious because it targets an *authorized user* on an already-compromised machine. In a typical attack chain, an adversary gains initial access (phishing, drive-by download, vendor compromise), then uses CVE-2026-41091 to escalate from user-level code execution to SYSTEM privileges. From SYSTEM, they disable Defender (CVE-2026-45498), deploy persistence, and laterally move through the network. The two vulnerabilities work in tandem as a privilege-escalation-then-disable tactic.
The federal patching mandate creates an unusual pressure cooker: FCEB agencies have 13 days from May 21 to June 3 to patch billions of endpoints. History shows that rapid, mandatory patching windows create two risks: either defenders scramble and introduce operational failures through hasty deployment, or they miss the deadline, leaving critical infrastructure exposed. Threat actors are certainly watching federal compliance timelines—they know that every agency still vulnerable after June 4 is a prime target.
Organizations outside the FCEB should treat this with equal urgency. These flaws affect consumer Windows, enterprise deployments, and cloud infrastructure. If you're running Defender (and most organizations running Windows do), assume it's a target.
— HackWire Editorial
## Related Coverage