CISA Issues Alert on Exploited Microsoft Defender Zero-Day Vulnerabilities

CISA has issued an urgent alert warning organizations about two newly disclosed zero-day vulnerabilities affecting Microsoft Defender, both added to the Known Exploited Vulnerabilities (KEV) catalog on May 20, 2026.

CVE-2026-45498: Microsoft Defender DoS Vulnerability

CVE-2026-45498 is a denial-of-service (DoS) vulnerability in Microsoft Defender that can cause the security service to stop functioning. An attacker could exploit this flaw to turn off protection mechanisms, leaving systems exposed to further compromise.

Although technical details remain limited, DoS vulnerabilities in security tools are particularly dangerous because they directly impact defensive visibility and response capabilities.

CVE-2026-41091: Privilege Escalation via Link Following

CVE-2026-41091 is a link-following vulnerability (CWE-59) that allows a locally authorized attacker to escalate privileges. This issue occurs when Microsoft Defender improperly handles symbolic links, enabling attackers to redirect file operations and gain higher-level access.

Such vulnerabilities are often used after initial access to move laterally or execute restricted actions within compromised environments.

CISA has confirmed that both vulnerabilities are actively exploited in the wild. However, there is currently no verified evidence linking them directly to ransomware campaigns.

Despite this, the risks remain significant:

• Attackers can exploit the DoS flaw to turn off endpoint protection.
• Privilege escalation can enable deeper system compromise.
• Combined exploitation may lead to full control over affected systems.

Under Binding Operational Directive (BOD) 22-01, U.S. federal agencies must remediate these vulnerabilities by June 3, 2026.

CISA recommends:

• Applying Microsoft-issued patches or mitigations immediately.
• Following BOD 22-01 guidance for cloud and enterprise environments.
• Discontinue affected products if fixes are unavailable.

These vulnerabilities demonstrate that even security tools can become attack vectors. Threat actors increasingly target endpoint protection solutions to weaken defenses before launching broader attacks.

Organizations using Microsoft Defender should enhance monitoring, restrict privileges, and deploy layered security controls to reduce risk.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.