Microsoft Defender’s False Disabled Alerts Hit Windows Users Globally

Microsoft Defender began showing misleading alerts on 28 August 2026, telling users across supported Windows editions that the antivirus was inactive. Microsoft said the messages were false notifications caused by a routine update, rather than evidence of malware or a compromised security system. According to the report, Defender continued running automatic scans and blocking dangerous downloads despite the warnings.

The issue affected Windows 11 versions 23H2 through 26H1, several Windows 10 versions, and Windows Server releases from 2012 to 2025. Microsoft has since issued a definition update to correct the problem. Updating Defender to version 4.18.26080.4 or later should remove the inaccurate alerts. The article cites Microsoft’s Windows release health dashboard and reports from technology outlets as evidence that the fix is effective.

Users should distinguish these phantom warnings from genuine alerts. If Defender still reports that it is disabled after the update—particularly where no alternative antivirus is installed—Microsoft’s guidance, as presented in the article, is to investigate the system’s security status rather than assume the message is another display error.