FROM 28 August 2026, Microsoft Defender reportedly displayed misleading alerts claiming that the antivirus was inactive, even though its protection continued to operate. Microsoft said the messages were phantom notifications caused by a routine update, rather than evidence of malware or a genuine loss of protection. The issue affected supported Windows editions, including Windows 11 versions 23H2 through 26H1, several Windows 10 versions, and Windows Server releases from 2012 to 2025.
According to the report, Defender continued to run automatic scans and block dangerous downloads while the erroneous status messages appeared. Microsoft has since issued a definition update intended to resolve the problem. Users should update Defender to version 4.18.26080.4 or later; the article says this removes the false alerts.
Genuine warnings may still appear if Defender has actually been disabled without another antivirus product being installed, so alerts that persist after updating should be checked against the system’s security status.