KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2026-45498
4.0
PoC Available
KEV
Active Exploitation
Details
VulnerabilityMicrosoft Defender Denial of Service Vulnerability
VendorMicrosoft
ProductDefender
Date added2026-05-20
Due date2026-06-03
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-400
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Descriptions
KEV: Microsoft Defender contains an unspecified vulnerability that allows for denial of service.
NVD: Microsoft Defender Denial of Service Vulnerability
Compliance SSVC + BOD 26-04
Automatableno
Technical impactpartial
Exploitation statusactive
3-day qualifyingNo
Public timeline14 days
Non-public timeline14 days
Forensic (public)Not required
Forensic (non-public)Not required
Research metadata
Last researched2026-08-26 12:42 UTC
Wall time0.4s
Searches3
Component defaultyes
Sources
https://www.helpnetsecurity.com/2026/05/21/microsoft-defender-vulnerabilities-cve-2026-41091-cve-2026-45498/
https://www.securityweek.com/microsoft-patches-exploited-undefend-and-redsun-defender-zero-days/
https://www.csoonline.com/article/4175970/microsoft-patches-two-zero-day-flaws-in-defender.html
https://www.sentinelone.com/vulnerability-database/cve-2026-45498/
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498
https://github.com/Nightmare-Eclipse/Undefend
https://integsec.com/blog/cve-2026-45498-microsoft-defender-denial-of-service-flaw-what-it-means-for-your-business-and-how-to-respond
https://www.securityweek.com/microsoft-patches-exploited-undefend-and-redsun-defender-zero-days/
https://www.csoonline.com/article/4175970/microsoft-patches-two-zero-day-flaws-in-defender.html
https://www.sentinelone.com/vulnerability-database/cve-2026-45498/
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498
https://github.com/Nightmare-Eclipse/Undefend
https://integsec.com/blog/cve-2026-45498-microsoft-defender-denial-of-service-flaw-what-it-means-for-your-business-and-how-to-respond
QC notes
info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)
warn component_extraction: Component 'Microsoft Defender Antimalware Platform scanning engine (MsMpEng.exe)' matches or contains product name 'Defender' — no specific component identified
Hunting hypothesis agent
Hunt Windows Defender operational logs for MsMpEng.exe crash events (Event ID 5001/5007/5010) and stale signature-update timestamps following resource exhaustion triggered by the UnDefend CVE-2026-45498 on-access scanner DoS.
Research details
ComponentMicrosoft Defender Antimalware Platform scanning engine (MsMpEng.exe)
PreconditionsMicrosoft Defender must be enabled (disabled systems not exploitable) and version below 4.18.26040.7. The attacker delivers specially crafted content (file write, email attachment, web download, network share) triggering Defender's on-access scan. No authentication, privileges,or user interaction required. The scanning engine processes malformed input without resource limits (memory/CPU/time), causing uncontrolled resource consumption (CWE-400) crashing MsMpEng.exe. agent
DeliveryAn attacker delivers specially crafted content to the target system through any channel that triggers Microsoft Defender's on-access scanning: file write to disk, email attachment, web download, content traversing a monitored network share, or removable media. Defender's real-time protection module automatically inspects the content, and the malformed input causes the scanning engine (MsMpEng.exe) to enter an uncontrolled resource consumption state, crashing or hanging the service and leaving the endpoint unprotected against follow-on malware.
Public PoCyes
PoC URLs
https://github.com/Nightmare-Eclipse/Undefend
Third-party repos; verify before use.
Exploit notesCVSS attack complexity: LOW (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; also scored as AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H per some sources). A public PoC named "UnDefend" by researcher Nightmare Eclipse (Chaotic Eclipse) is available on GitHub. The PoC runs in two modes: passive (blocks signature updates) and aggressive (completely disables Defender by crashing MsMpEng.exe). Exploitation has been observed in live intrusions by Huntress incident responders alongside BlueHammer and RedSun exploits.
SummaryMicrosoft Defender Antimalware Platform Denial of Service Vulnerability (CVE-2026-45498), also known as "UnDefend". This uncontrolled resource consumption (CWE-400) vulnerability in the Microsoft Defender Antimalware Platform scanning engine (MsMpEng.exe) allows an unauthenticated attacker to crash or disable Defender by delivering specially crafted content that triggers resource exhaustion during on-access scanning. A public PoC was released by researcher Nightmare Eclipse and active exploitation has been confirmed in the wild. Microsoft patched this in Antimalware Platform version 4.18.26040.7. CISA added it to the KEV catalog on 2026-05-20.
Tia coverage
First reported2026-05-21
First exploit report2026-05-21
Exploit report → KEV1 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
microsoft-defender-zero-days-cve-2026-41091-cve-2026-45498-activ
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.