Microsoft product
Defender Alert ← All Microsoft products
No CISA KEV deadline is open. CISA last added a Defender CVE on 20 May.
Tracked since 14 Apr · latest article Thu 10 Sep · RSS
CVE Product Added Due · federal deadline
Deadlines passed
CVE-2026-41091 Defender 20 May Ransomware: Unknown · 7 articles CVE-2026-45498 Defender 20 May Ransomware: Unknown · 4 articles CVE-2026-33825 Defender 22 Apr Ransomware: Known · 17 articles CVE-2022-44698 not in CyberSIXT coverage Defender 13 Dec 2022 Ransomware: Known · 0 articles CVE-2017-8540 not in CyberSIXT coverage Malware Protection Engine 3 Mar 2022 Ransomware: Unknown · 0 articles CVE-2021-1647 not in CyberSIXT coverage Defender 3 Nov 2021 Ransomware: Unknown · 0 articles 45 articles from 12 outlets since 14 Apr; the latest 46 days ago.
Defender: coverage over time 45 articles from 12 outlets. First report 14 Apr by SANS ISC. Busiest week: 9 articles, week of 18 May. 0 in the last 7 days.
Jun Aug Oct 22 Mar Now 45 per week First report SANS ISC · 14 Apr Added to CISA KEV · CVE-2026-41091 Defender Defender: coverage over time 45 articles from 12 outlets. First report 14 Apr by SANS ISC. Busiest week: 9 articles, week of 18 May. 0 in the last 7 days.
May Jun Jul Aug Sep Oct 22 Mar Now 45 per week First report SANS ISC · 14 Apr Added to CISA KEV · CVE-2026-41091 Defender Latest Dark Reading · 46 days ago
Show as table Defender: articles Published (UTC) Outlet Headline Thu 10 Sep · 16:12 UTC Dark Reading Windows Defender Patch Bypass Exposes SYSTEM Files to Attackers Thu 10 Sep · 12:49 UTC SOCRadar Public ShieldCrash PoC Claims to Bypass Microsoft Defender Fix Thu 10 Sep · 07:30 UTC SecurityWeek Microsoft Defender Zero Day Bypasses Patches to Expose Windows Systems Wed 9 Sep · 09:29 UTC The Hacker News Microsoft Defender Zero Day Bypasses Patch to Read Windows Files as SYSTEM Wed 9 Sep · 08:50 UTC Security Affairs ShieldCrash PoC Revives Microsoft Defender SYSTEM File Read Flaw Wed 9 Sep · 01:01 UTC SecurityOnline Microsoft Defender 0day PoC Exposes SYSTEM Files on Windows Mon 17 Aug · 14:21 UTC Malwarebytes ShieldBreak bypasses Microsoft’s patch for earlier Defender flaw Thu 13 Aug · 08:51 UTC SecurityWeek ShieldBreak exploit hits Microsoft Defender via CVE-2026-50656 Wed 12 Aug · 08:32 UTC Security Affairs Proof of concept bypasses Defender patch for CVE-2026-50656 Wed 12 Aug · 06:26 UTC SecurityOnline ShieldBreak Exploit Exposes Defender Patch Flaw CVE-2026-50656 Thu 9 Jul · 21:01 UTC Dark Reading Microsoft patches Windows Defender zero day CVE-2026-50656 Thu 9 Jul · 21:01 UTC Ars Technica Patch for Windows Defender 0-day could allow attackers to fill hard disk Thu 9 Jul · 11:47 UTC Malwarebytes Microsoft patches zero day EoP flaw in Defender, CVE-2026-50656 Thu 9 Jul · 11:46 UTC Security Affairs Microsoft patches Defender bug CVE-2026-50656 after local exploit Thu 9 Jul · 11:09 UTC SecurityOnline Microsoft Patches RoguePlanet Defender Zero-Day That Grants SYSTEM Access Thu 9 Jul · 11:09 UTC SecurityWeek Microsoft patches privilege escalation flaw CVE-2026-50 Wed 1 Jul · 12:26 UTC Security Affairs CISA warns BlueHammer flaw now used in ransomware attacks Tue 30 Jun · 14:20 UTC SecurityWeek BlueHammer Defender Flaw Linked to Ransomware Exploits Thu 18 Jun · 13:30 UTC Malwarebytes Microsoft Defender Bug CVE-2026-50656 Allows Full Windows Control Thu 18 Jun · 10:30 UTC Security Affairs Microsoft Defender Zero Day Lets Attackers Run SYSTEM Code Wed 17 Jun · 10:10 UTC SecurityWeek Microsoft Defender bug CVE-2026-50656 allows admin takeover Tue 9 Jun · 23:49 UTC Security Affairs Microsoft patches CVE-2026-41091 amid record 208 CVE update Thu 21 May · 21:32 UTC Security Affairs CISA Adds Critical Flaws in Windows, Office, Defender to KEV List Thu 21 May · 18:41 UTC Malwarebytes Microsoft Defender vulnerabilities are being exploited in the wild Thu 21 May · 10:21 UTC SecurityWeek Microsoft fixes two zero day Defender bugs under active attack Wed 20 May · 20:13 UTC CISA CISA adds CVE-2026-45498 to KEV, urges Defender patch by June Wed 20 May · 20:13 UTC CISA CISA warns of active exploit in Microsoft Defender CVE-2026-41091 Wed 20 May · 19:47 UTC CISA CISA Adds Microsoft Defender DoS Flaw CVE-2026-45498 to KEV List Wed 20 May · 19:45 UTC CISA CISA warns of active exploit in Microsoft Defender CVE-2026-41091 Wed 20 May · 18:02 UTC CISA CISA adds seven KEV flaws, including 2026 Microsoft Defender bugs Tue 19 May · 22:01 UTC Dark Reading Windows Zero-Day Barrage Continues After Patch Tuesday Fri 15 May · 07:21 UTC Security Affairs Windows Zero Days YellowKey & GreenPlasma Expose BitLocker Bypass Thu 23 Apr · 10:30 UTC Security Affairs CISA urges patch Microsoft Defender flaw CVE-2026-33825 by May 6 Thu 23 Apr · 08:31 UTC SecurityWeek Recent Microsoft Defender Vulnerability Exploited as Zero-Day Wed 22 Apr · 23:03 UTC CISA CISA adds Microsoft Defender flaw CVE-2026-33825 to KEV list Wed 22 Apr · 22:11 UTC CISA CISA adds Microsoft Defender flaw CVE-2026-33825 to KEV list Tue 21 Apr · 20:01 UTC Dark Reading Exploits Turn Windows Defender into Attacker Tool Sun 19 Apr · 18:13 UTC Security Affairs Microsoft Defender under attack as three zero-days, two of them still unpatched, enable elevated access Wed 15 Apr · 10:54 UTC Malwarebytes April Patch Tuesday patches two Microsoft zero day flaws Wed 15 Apr · 09:57 UTC Infosecurity Microsoft Fixes Two Zero-Days in April Patch Tuesday Wed 15 Apr · 06:42 UTC Security Affairs Microsoft fixes SharePoint zero day CVE-2026-32201 in April Tue 14 Apr · 22:32 UTC Rapid7 Microsoft patches 167 flaws, including exploited SharePoint bug Tue 14 Apr · 22:00 UTC Dark Reading Privilege Elevation Dominates Massive Microsoft Patch Update Tue 14 Apr · 18:32 UTC SecurityWeek Microsoft patches SharePoint zero day CVE-2026-32201 in the wild Tue 14 Apr · 18:31 UTC SANS ISC Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)
Who reported 12 outlets, last 12 months
11 8 7 5 5 3 6 See the full timeline 10 Sep Windows Defender Patch Bypass Exposes SYSTEM Files to Attackers Dark Reading 10 Sep Public ShieldCrash PoC Claims to Bypass Microsoft Defender Fix SOCRadar 10 Sep Microsoft Defender Zero Day Bypasses Patches to Expose Windows Systems SecurityWeek 9 Sep Microsoft Defender Zero Day Bypasses Patch to Read Windows Files as SYSTEM The Hacker News 9 Sep ShieldCrash PoC Revives Microsoft Defender SYSTEM File Read Flaw Security Affairs 9 Sep Microsoft Defender 0day PoC Exposes SYSTEM Files on Windows SecurityOnline 17 Aug ShieldBreak bypasses Microsoft’s patch for earlier Defender flaw Malwarebytes 13 Aug ShieldBreak exploit hits Microsoft Defender via CVE-2026-50656 SecurityWeek 12 Aug Proof of concept bypasses Defender patch for CVE-2026-50656 Security Affairs 12 Aug ShieldBreak Exploit Exposes Defender Patch Flaw CVE-2026-50656 SecurityOnline
All CVEs in coverage 5 Exploited EPSS CVSS Newest CVE-2026-45498 Microsoft Defender Denial of Service Vulnerability CVSS 4.0 Medium Exploited 63% EPSS 4 articles CVE-2026-41091 Microsoft Defender Link Following Vulnerability CVSS 7.8 High Exploited 8.2% EPSS 7 articles CVE-2026-33825 Microsoft Defender Insufficient Granularity of Access Control Vulnerability CVSS 7.8 High Exploited 6.8% EPSS 17 articles CVE-2026-69414 Microsoft Malware Protection Engine vulnerability CVSS 7.8 High – Not in KEV 1.3% EPSS 7 articles CVE-2026-50656 Microsoft Malware Protection Engine vulnerability CVSS 7.8 High – Not in KEV 0.4% EPSS 13 articles How these numbers are made CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.
CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.
Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.
Product names are grouped by normalised names, with version and edition tails removed.
Fix listed refers to an advisory. Unknown fix status is counted as not listed.