Critical Microsoft Defender for Endpoint Flaw Exposes Linux Servers

Key Takeaways

• A recent update to Microsoft Defender for Endpoint on Linux temporarily disabled antivirus protection on servers.
• The vulnerability affected specific Linux platform builds 101.26042.0000 through 101.26042.0009 after an upgrade and system reboot.
• Impacted Linux servers were left without active protection, creating a critical security gap.
• Microsoft has released platform version 101.26042.0011 to fix the issue and advises immediate upgrade.

A significant flaw in a recent update for Microsoft Defender for Endpoint on Linux servers inadvertently deactivated the antivirus protection following system upgrades and subsequent reboots. This critical lapse left numerous Linux machines vulnerable to cyber threats until a resolution was deployed by Microsoft.

The problem specifically impacted Linux platform builds 101.26042.0000 through 101.26042.0009. Upon updating and restarting, the Defender service on these systems could enter a disabled state, effectively rendering them unprotected against malicious activities.

Reports from system administrators across various community forums corroborated the real-world implications of this vulnerability. One administrator detailed how the mdatp service, running version 101.26042.0009, ceased functioning after a series of weekend patch reboots, necessitating urgent intervention across their server infrastructure.

In response to the identified issue, Microsoft took swift action by withdrawing the problematic builds from its production channel for all supported Linux distributions. This measure ensures that these flawed versions are no longer available for new installations, preventing further exposure.

Microsoft Defender for Endpoint Impacts Linux

This incident marks another instance where Defender’s Linux agent has encountered service disruptions linked to upgrades. A comparable bug in the January 2026 release, which affected real-time scanning, led to unexpected reboots on systems equipped with hardware watchdogs.

To rectify the service-disabling problem, Microsoft has now released platform version 101.26042.0011. Organizations utilizing the affected builds or older supported versions are strongly advised to upgrade directly to this new build to restore full protection.

Administrators should not merely assume that an upgrade resolves the vulnerability. It is crucial to actively verify the Defender health status on all Linux endpoints, as the disabled state could persist silently even after the update and reboot. A silently inactive endpoint agent represents a significant security blind spot, particularly given that Linux servers often host critical business applications and may lack the extensive visibility tools commonly found in Windows environments. This situation serves as a vital reminder for security teams to implement active monitoring of agent health rather than relying solely on the reported success of updates.

This event unfolds as Microsoft continues to refine its broader update delivery mechanisms for Defender, including efforts to decouple Windows EDR sensor updates from monthly OS patches to accelerate deployment. While these changes aim to enhance responsiveness, the Linux service-disable bug highlights that faster update cycles inherently carry regression risks. Consequently, thorough post-update verification remains an indispensable step for any organization managing a diverse fleet of operating systems.

What You Should Do

• Execute mdatp health on all Linux endpoints to confirm the platform build is 101.26042.0011 or a newer version.
• Consult the Microsoft Defender portal’s “Device health” report to identify any endpoints that still indicate an inactive or disabled antivirus status.
• Prioritize immediate remediation for internet-facing or high-value Linux servers, as these systems present the greatest risk during any period of protection lapse.
• Review recent patch and reboot logs to pinpoint machines that underwent the vulnerable upgrade path between the release of the affected build and the 101.26042.0011 fix.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.