CISA Warns of Actively Exploited Critical Microsoft Defender Vulnerabilities

Key Takeaways

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding two critical, actively exploited vulnerabilities in Microsoft Defender.
• These flaws, identified as CVE-2026-45498 and CVE-2026-41091, could allow attackers to cause denial-of-service or escalate privileges on affected systems.
• Organizations, particularly federal agencies, must apply Microsoft’s security updates and mitigations by June 3, 2026, as per CISA’s Binding Operational Directive (BOD) 22-01.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert concerning two actively exploited vulnerabilities within Microsoft Defender. These security flaws, now prominently featured in CISA’s Known Exploited Vulnerabilities (KEV) catalog, pose significant risks to organizations globally.

The identified vulnerabilities, tracked as CVE-2026-45498 and CVE-2026-41091, impact Microsoft Defender and could potentially enable threat actors to disrupt system operations or achieve elevated access privileges.

Both vulnerabilities were added to the KEV list on May 20, 2026. A strict remediation deadline of June 3, 2026, has been set under Binding Operational Directive (BOD) 22-01, mandating immediate action from federal agencies and other organizations leveraging Microsoft Defender.

Microsoft Defender Exploits Detailed

CVE-2026-45498: Denial-of-Service Vulnerability

The first vulnerability, CVE-2026-45498, is categorized as a denial-of-service (DoS) flaw affecting Microsoft Defender. While specific technical details remain under wraps, successful exploitation of this weakness could allow malicious actors to impede or halt Defender’s operations. Such a disruption would severely compromise endpoint protection, leaving systems vulnerable to further intrusions and potential compromise.

CVE-2026-41091: Privilege Escalation Through Link Following

The second flaw, CVE-2026-41091, is a link-following vulnerability (CWE-59). This issue arises from improper handling of symbolic links, which an authorized local attacker can exploit to achieve privilege escalation. By leveraging this vulnerability, attackers could gain elevated access on targeted systems, significantly increasing the risk of lateral movement across networks and deeper system penetration.

Although CISA has not explicitly linked these vulnerabilities to ongoing ransomware campaigns, their inclusion in the KEV catalog serves as definitive proof of active exploitation in real-world attack scenarios. Cybersecurity researchers consistently highlight that sophisticated threat actors and ransomware groups frequently employ privilege escalation and defense evasion tactics.

The presence of both a DoS vulnerability and a privilege escalation flaw within a widely deployed security product like Microsoft Defender is particularly alarming. This combination raises serious concerns about potential defense bypass scenarios, where attackers could disable security protections before deploying malware or executing post-exploitation activities.

What You Should Do

• Immediately apply all security updates and mitigations released by Microsoft for Defender.
• Adhere strictly to the guidelines outlined in CISA’s BOD 22-01 for both cloud and on-premises environments.
• Implement continuous monitoring for any unusual system behavior, especially disruptions to Microsoft Defender services.
• Enforce strict local access privilege restrictions to minimize the window of opportunity for exploitation.
• If patches are unavailable for affected systems, consider temporarily discontinuing their use until a fix is deployed.
• Review endpoint detection and response (EDR) logs meticulously for any anomalies that might indicate attempted exploitation.
• Adopt a comprehensive, layered defense strategy that integrates robust endpoint protection with behavioral monitoring, up-to-date threat intelligence, and agile patch management processes.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.