Microsoft Warns of Two Actively Exploited Defender Vulnerabilities

Microsoft has disclosed two actively exploited vulnerabilities in Windows Defender that pose significant security risks.

• •CVE-2026-41091 (CVSS 7.8) is a privilege escalation vulnerability allowing attackers to gain SYSTEM privileges through improper link resolution before file access
• •CVE-2026-45498 (CVSS 4.0) is a denial-of-service flaw affecting Defender
• •Both vulnerabilities are patched in Microsoft Defender Antimalware Platform versions 1.1.26040.8 and 4.18.26040.7
• •CISA has added both to its Known Exploited Vulnerabilities catalog with a June 3, 2026 mandatory patch deadline for Federal agencies
• •No manual action is required as Microsoft Defender automatically updates malware definitions and the Protection Engine