Microsoft has shipped out-of-band patches for two Microsoft Defender flaws that are already being exploited in the wild, and CISA has added both to its Known Exploited Vulnerabilities catalog.

The two issues are not equally severe on paper, but together they describe a dangerous pattern. CVE-2026-41091 lets a low-privileged attacker escalate to SYSTEM through the Defender scanning engine. CVE-2026-45498 can knock Defender offline. One gives an attacker control of the machine. The other removes the sensor that would have seen it happen.

That combination matters because of where it lives. This is not a flaw in a public web service, an exposed VPN appliance, or an internet-facing login page. It is a flaw inside the endpoint protection layer itself — the software defenders trust to detect intrusions in the first place.

The Threat at a Glance

Why These Vulnerabilities Matter

Most endpoint vulnerabilities are about getting onto a machine. These two are about what happens to the defender’s own tooling once an attacker is already there.

CVE-2026-41091 is the more serious of the pair. It is a local privilege escalation flaw in the Microsoft Malware Protection Engine, the component that provides the scanning, detection, and cleaning capability behind Microsoft’s antivirus and antispyware products. Microsoft rates it CVSS 7.8 and confirms that successful exploitation gives an attacker SYSTEM privileges. It requires only low privileges to start and no user interaction.

CVE-2026-45498 is lower-scored at CVSS 4.0, but its operational meaning is not measured by severity alone. It can place Defender into a denial-of-service state, meaning the protection that should be running is no longer running as intended.

The distinction worth holding onto is this. A privilege escalation bug on an ordinary application is serious. A privilege escalation bug inside the antivirus engine is different, because that engine runs with deep system access and is one of the most trusted processes on a Windows host. The attacker is not bypassing the defense from outside. The attacker is riding it.

CVE-2026-41091 is a link-following weakness, classified under CWE-59 as improper link resolution before file access. In plain terms, the Malware Protection Engine can be tricked into following a crafted symbolic link or directory junction before it accesses a file during a scan.

The mechanism is what makes it dangerous. By manipulating Defender into following an attacker-controlled link, an attacker can force the engine to read, write, or delete arbitrary system files. A concrete example would be redirecting one of Defender’s own file-write operations so that it overwrites a critical system file. Because the engine performs that action with high privilege, the result is a local low-privileged user reaching SYSTEM-level control of the machine, with no user interaction required.

CVE-2026-45498 sits on the same component family and produces a denial-of-service condition against Defender. Microsoft credited external researchers for reporting the privilege escalation flaw, but credited no one for the denial-of-service issue, which is often an indicator that a vulnerability was found through observed activity rather than coordinated disclosure.

When the Security Sensor Becomes the Attack Surface

A SYSTEM-level escalation on an ordinary service is a bad day. A SYSTEM-level escalation inside the antivirus engine is a different category of problem, because the compromise inherits the trust the security product carries.

Endpoint protection is supposed to be the thing watching everything else. When the watcher itself is the escalation path, the attacker gains privilege through the one process least likely to be questioned. Telemetry from a compromised security agent is not a reliable account of what happened on the box.

CVE-2026-45498 makes the picture worse when the two are considered together. An attacker who can place Defender into a denial-of-service state can remove the very telemetry a responder would use to detect everything that follows. Escalate through one flaw, silence the sensor with the other, and operate in the dark. The defender is left reasoning about an incident using a tool that may have been blind for part of it.

In practical terms, defenders should treat unexpected Defender health changes, service stops, and engine errors as security-relevant signals, not just IT noise.

The technical flaws are serious on their own. The timeline around them is what makes this a campaign rather than a coincidence.

Read together, this is not a pair of isolated bugs. It is roughly six weeks of public proof-of-concept code, observed real-world use, and successive KEV additions, all aimed at the same product: the endpoint defense layer. When an attacker community is already focused on a specific component and already holds working exploit code, a new CVE in that component does not behave like a fresh, isolated event. It behaves like the next move in an ongoing campaign.

What Defenders Should Do Now

This is not a routine antivirus update to leave to automatic patching and forget. If Windows endpoints exist in the environment, defenders should confirm the Defender engine version across the estate and look for evidence that the engine was abused before the patch landed. Start by validating that Microsoft Malware Protection Engine is updated past the affected 1.1.26030.3008 build, especially on managed devices, servers, offline systems, privileged workstations, and machines that may not receive automatic updates reliably.

Defenders should also pull the exact fixed build numbers directly from Microsoft’s advisory rather than relying on secondhand reporting, because reported version strings can vary across coverage. The important question is not whether Defender is present, but whether the vulnerable engine and platform versions have actually been replaced.

After version validation, the review should move to behavior. Defender operational logs should be checked for unusual file-access patterns, symbolic-link activity, junction activity, unexpected engine errors, service interruptions, disabled real-time protection, or health-state changes. Those events should not be dismissed as routine endpoint noise. In the context of CVE-2026-41091 and CVE-2026-45498, they may be signs that the security sensor itself was manipulated.

Security teams should also cross-reference the known public proof-of-concept activity around BlueHammer, RedSun, and UnDefend. If Defender behaved abnormally during the past several weeks, that period deserves closer review. Automatic engine updates reduce exposure going forward, but they do not answer the more important incident-response question: whether the flaw was already used before the update arrived.

The Bigger Lesson

It is tempting to read endpoint protection as purely defensive infrastructure. These two CVEs are a reminder that the security agent is also software, also privileged, and therefore also a target.

The pattern here echoes a theme ByteVanguard has tracked across edge devices, remote management tools, and identity infrastructure: attackers prioritize the systems that sit closest to trust. Antivirus belongs on that list. It runs everywhere, it runs with high privilege, and it is rarely treated as something that itself needs to be watched.

The shrinking exploitation window applies here too. With public proof-of-concept code circulating for weeks and confirmed in-the-wild use ahead of the out-of-band patch, the gap between disclosure and exploitation was not theoretical. It had already closed.

References & Original Sources

• Microsoft Security Response Center: CVE-2026-41091
• Microsoft Security Response Center: CVE-2026-45498
• CISA: Known Exploited Vulnerabilities Catalog
• Help Net Security: Microsoft Defender vulnerabilities exploited in the wild
• BleepingComputer: Microsoft warns of new Defender zero-days exploited in attacks
• The Hacker News: Microsoft Warns of Two Actively Exploited Defender Vulnerabilities

ByteVanguard tracks CISA KEV activity, exploited vulnerabilities, AI security, and enterprise threat intelligence. Subscribe for weekly briefings.