Microsoft has formally acknowledged a serious security vulnerability in its Defender antivirus software and is working on a patch, one week after a security researcher publicly disclosed the flaw.