Malwarebytes
Microsoft Defender vulnerabilities are being exploited in the wild
On May 21, 2026, it was reported that two vulnerabilities within Microsoft Defender are actively being exploited. These were added to the CISA's Known Exploited Vulnerabilities catalog, indicating that they pose significant risks. The vulnerabilities include:
1. CVE-2026-41091: An elevation of privilege vulnerability (CVSS score 7.8), allowing attackers with local access to gain SYSTEM-level control.
2. CVE-2026-45498: A denial-of-service vulnerability (CVSS score 4.0), enabling attackers to hinder Defender's operations, potentially allowing malware to run undetected.
It is crucial for users and organizations relying on Microsoft Defender to install patches, especially if they manage shared systems. Users are advised to enable Windows Updates and confirm they have the latest Defender platform version 4.18.26040.7 installed to mitigate these vulnerabilities.
AI summary of the original article from Malwarebytes, written automatically by a language model. Quotes, figures and names come from that article; check it before relying on a detail. Read the original · How summaries are made
Story timeline CVE-2026-41091
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 20 May · 18:02 UTC | CISA | CISA adds seven KEV flaws, including 2026 Microsoft Defender bugs |
| Wed 20 May · 19:45 UTC | CISA | CISA warns of active exploit in Microsoft Defender CVE-2026-41091 |
| Wed 20 May · 20:13 UTC | CISA | CISA warns of active exploit in Microsoft Defender CVE-2026-41091 |
| Thu 21 May · 10:21 UTC | SecurityWeek | Microsoft fixes two zero day Defender bugs under active attack |
| Thu 21 May · 18:41 UTC | Malwarebytes | Microsoft Defender vulnerabilities are being exploited in the wild (this article) |
| Thu 21 May · 21:32 UTC | Security Affairs | CISA Adds Critical Flaws in Windows, Office, Defender to KEV List |
| Tue 9 Jun · 23:49 UTC | Security Affairs | Microsoft patches CVE-2026-41091 amid record 208 CVE update |