InfoSecBulletin Cybersecurity for mankind
Two new Microsoft Defender flaws have been found, and they are being used by attackers. This allows local attackers to gain SYSTEM level access and could interrupt protection on Windows systems.
The bugs are called CVE‑2026‑41091 (Elevation of Privilege) and CVE‑2026‑45498 (Denial of Service). They were shared on May 19, 2026, and impact key Microsoft Defender parts used in all supported Windows versions.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
Microsoft Defender Elevation of Privilege Vulnerability
CVE‑2026‑41091 is an “Important” vulnerability that allows someone to gain higher access due to a mistake in how links are handled in Microsoft Defender’s scanning process.
Microsoft confirms that this vulnerability has been publicly disclosed and is already under active exploitation, with its exploitability index showing “Exploitation Detected.”
Successful exploitation lets attackers turn off or mess with security tools, put in lasting software, access sensitive information, and create new high-level accounts, greatly increasing the damage of any initial breach.
Microsoft Defender Denial of Service Vulnerability
The second flaw, CVE‑2026‑45498, is a problem in Microsoft Defender that can cause a Denial-of-Service.
It has also been publicly disclosed and is confirmed as exploited in the wild, with “Exploitation Detected” status in Microsoft’s exploitability assessment.
Attackers can misuse this platform weakness to crash or weaken Defender’s protection. This gives them a chance for more attacks and staying hidden.
The last affected version is 4.18.26030.3011, and fixes are in version 4.18.26040.7. Like the engine bug, systems with Defender turned off may look weak in scans because of version checks on installed files, even if they can’t be exploited.
The U.S. Cybersecurity Agency has added CVE‑2026‑41091 and CVE‑2026‑45498 to its list of known vulnerabilities. This shows that they have been used in real attacks.
Required Actions for Defenders
Microsoft highlights that you do not need to install a separate manual security update. The standard Defender engine and platform updates do this automatically and often.
Administrators should:
Confirm that the Defender engine version is at least 1.1.26040.8 and the Antimalware Platform version is at least 4.18.26040.7 on all endpoints.
Use the Windows Security app to check “Virus & threat protection,” then “Protection updates,” and select “Check for updates” to force an update where necessary.
In Windows Security → Settings → About, verify that the Antimalware Client version meets or exceeds the fixed versions.
