Reported by 2 outlets
Microsoft Defender Zero-Days (CVE-2026-41091, CVE-2026-45498) — Actively Exploited, CISA Adds to KEV
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Microsoft Defender Zero-Days (CVE-2026-41091, CVE-2026-45498) — Actively Exploited, CISA Adds to KEV
bleepingcomputer.com · 146d ago · May 21st, 2026
Microsoft rolled out emergency patches for two Microsoft Defender vulnerabilities that are being actively exploited in zero-day attacks. CVE-2026-41091 is a privilege escalation flaw in the Malware Protection Engine (versions ≤1.1.26030.3008) stemming from improper link resolution before file access — allowing attackers to gain SYSTEM privileges. CVE-2026-45498 affects the Microsoft Defender Antimalware Platform (≤4.18.26030.3011) and enables denial-of-service attacks against unpatched Windows devices. CISA added both to its Known Exploited Vulnerabilities catalog, ordering federal agencies to secure endpoints by June 3. Microsoft has released Malware Protection Engine versions 1.1.26040.8 and 4.18.26040.7; automatic updates should deliver the fix, but organizations should verify installation.
-
update from malware.news
Check Point Research: Microsoft Defender Boot-Time Recovery Driver Can Be Abused to Delete Security Software
malware.news · 48d ago · August 26th, 2026
Check Point Research demonstrated that Microsoft Defender's officially signed boot-time recovery driver can be abused to delete arbitrary kernel-level security software on Windows systems ranging from Windows 7 to Windows 11 25H2. Article Link: https://malware.news/t/microsoft-defender/125104#post_1