Professional services

Back

George Sutton

George Sutton

May 22, 2026

Microsoft Releases Patches for Two Zero-Days Affecting Defender Malware Protection Engine

May 22nd, 2026

❓What:

Microsoft released emergency patches for two actively exploited zero-day vulnerabilities affecting Microsoft Defender. One flaw would allow attackers to escalate privileges to SYSTEM level and interfere with Defender security updates, significantly weakening endpoint protection.
The vulnerabilities impact the Microsoft Malware Protection Engine used across Defender products.
Researchers and threat intelligence reporting link the vulnerabilities to a broader series of publicly disclosed Microsoft zero-days released by the actor Nightmare-Eclipse (a.k.a. Chaotic-Eclipse).
Key vulnerabilities:
CVE-2026-41091 – Privilege escalation flaw allowing attackers to gain SYSTEM privileges.
CVE-2026-45498 – Security bypass and Denial-of-Service (DoS) flaw that can prevent Defender signature updates, reducing malware detection effectiveness.

⚠️Impact:

Attackers can obtain elevated privileges on compromised Windows systems.
Disabling or preventing Defender updates can leave organizations blind to emerging malware and ransomware threats.
Public proof-of-concept (PoC) exploit code increases the likelihood of widespread exploitation.
Organizations relying heavily on Microsoft Defender may face increased exposure if patching is delayed.

💡Recommendations:

Immediately patch affected Microsoft Defender and Malware Protection Engine versions.
Verify Windows Defender Anti-malware Platform updates and malware definitions are configured to install automatically:
- Open the Windows Security program.
- In the navigation pane, select Virus & threat protection.
- Then click on Protection Updates in the Virus & threat protection section updates.
- Select Check for updates.
- In the navigation pane, select Settings, and then select About.
- Examine the Anti-malware ClientVersion number.
Verify Defender signature and engine updates are functioning properly across all endpoints.
Monitor for unusual privilege escalation activity and Defender service tampering.
Implement endpoint detection and response (EDR) monitoring for abnormal SYSTEM-level processes.
Conduct vulnerability scanning to identify unpatched Windows assets.
Reinforce mandatory security awareness training so employees can recognize phishing and malware delivery attempts that could lead to initial compromise.