Microsoft Warns of Two Actively Exploited Defender Vulnerabilities
The Hacker News • • technology
Key Points:
- Microsoft has revealed two actively exploited vulnerabilities in Microsoft Defender: a privilege escalation flaw (CVE-2026-41091, CVSS 7.8) allowing attackers to gain SYSTEM privileges, and a denial-of-service bug (CVE-2026-45498, CVSS 4.0).
- Both vulnerabilities have been patched in Microsoft Defender Antimalware Platform versions 1.1.26040.8 and 4.18.26040.7, with automatic updates ensuring protection for most users.
- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added these flaws to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply fixes by June 3, 2026.
- This announcement follows another Microsoft vulnerability disclosed last week involving a cross-site scripting flaw in Exchange Server (CVE-2026-42897), also actively exploited.
- Additionally, CISA updated its KEV catalog to include older Microsoft and Adobe vulnerabilities from 2008-2010, highlighting ongoing risks from legacy software flaws.