Microsoft disclosed on May 20, 2026 that two vulnerabilities in Microsoft Defender were being actively exploited before a patch was available. The company shipped fixes the same day and confirmed that both flaws had already seen exploitation in the wild.
The first, CVE-2026-41091, is a local privilege escalation bug carrying a CVSS score of 7.8. It stems from improper link resolution in Defender's Malware Protection Engine, a flaw class known as link following. According to Microsoft's advisory, an authenticated attacker with low-level access can abuse symbolic or hard links to redirect file operations that Defender's remediation and cloud file rollback processes carry out with elevated permissions, allowing attacker-controlled files to land in protected directories such as C:\Windows\System32. From there, an attacker can escalate to SYSTEM privileges.
The second, CVE-2026-45498, is a denial-of-service vulnerability with a lower CVSS score of 4.0, rooted in uncontrolled resource consumption in the Defender Antimalware Platform. A crafted input can exhaust shared resources in the protection engine and push it into a non-functional state, effectively disabling real-time protection until the service recovers or is restarted.
Microsoft's advisory did not attribute either exploitation campaign to a specific actor or group, and this post makes no attempt to fill that gap. What the advisory does confirm is that public disclosure and active exploitation both occurred before patches were released, meeting Microsoft's own bar for a zero-day.
What got fixed
Microsoft addressed CVE-2026-41091 in Microsoft Malware Protection Engine version 1.1.26040.8, up from the vulnerable 1.26030.3008 baseline. CVE-2026-45498 was resolved in Defender Antimalware Platform version 4.18.26040.7. The same update round also patched a third flaw, CVE-2026-45584, a heap-based buffer overflow in Defender carrying a CVSS score of 8.1 that could allow remote code execution. Microsoft's advisory does not list CVE-2026-45584 as exploited; it was patched alongside the other two out of caution given its severity.
Because Defender updates through Microsoft's regular intelligence and platform update channel rather than a manual patch cycle for most consumer and many enterprise deployments, a large share of affected systems will have already received the fix automatically. Organizations that manage Defender updates manually, including those running offline or air-gapped endpoints with scheduled definition pushes, need to confirm they are on platform version 4.18.26040.7 or later and engine version 1.1.26040.8 or later.
CISA adds both flaws to the KEV catalog
CISA added CVE-2026-41091 and CVE-2026-45498 to its Known Exploited Vulnerabilities catalog on May 20, 2026, as part of a batch of seven entries logged that day. Under Binding Operational Directive 22-01, the addition requires federal civilian executive branch agencies to apply the vendor fix by June 3, 2026. CISA's KEV listing is itself confirmation of exploitation independent of Microsoft's own advisory language, since the catalog's inclusion criteria require evidence of active use in the wild before an entry is added.
The KEV deadline is a compliance obligation for federal agencies specifically, but security teams across other sectors commonly use KEV entries as a prioritization signal, since it means at least two parties, the vendor and CISA, have independently reached the same conclusion about real-world exploitation.
Why a Defender flaw matters more than most
Defender's privileged position as the built-in antimalware engine on Windows is what makes CVE-2026-41091 notable beyond its CVSS score. The vulnerability doesn't require Defender to have a design flaw in its detection logic; it targets the elevated file operations Defender performs when remediating threats or restoring files from cloud rollback, which by necessity run with permissions well above a standard user account. Any product in that position, security software included, becomes a target for privilege escalation research precisely because its normal operation already touches protected system paths.
CVE-2026-45498 is a smaller-scale problem in isolation, since a denial-of-service condition against Defender doesn't hand an attacker code execution or data access on its own. But paired with other tooling, an attacker who can knock out real-time protection on a target machine, even briefly, gains a window to deploy other payloads without triggering Defender's detection.
What to do
Security teams should confirm Defender platform and engine versions across managed fleets, with particular attention to any endpoints where update channels are restricted or manually gated. For organizations subject to CISA's KEV deadlines, the June 3, 2026 date applies to CVE-2026-41091 and CVE-2026-45498 specifically. Given that CVE-2026-45584 shipped in the same update and carries a higher CVSS score than either exploited flaw, there is no operational reason to delay applying it separately.
Sources: CISA: CISA Adds Seven Known Exploited Vulnerabilities to Catalog, May 20, 2026 · The Hacker News · Help Net Security · BleepingComputer