Microsoft issues emergency patches for actively exploited Defender flaws

Microsoft has released emergency security updates to address two vulnerabilities in its Defender antivirus software that are already being exploited by attackers. The company confirmed the active exploitation, a finding supported by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which has mandated federal agencies to apply patches.

The first and more severe vulnerability, tracked as CVE-2026-41091, is an elevation of privilege flaw with a CVSS severity score of 7.8. It stems from improper link resolution in the Microsoft Malware Protection Engine. An attacker with existing low-level access to a system could exploit this flaw locally to gain SYSTEM-level privileges, compromising the confidentiality, integrity, and availability of the affected device. The flaw affects the Microsoft Malware Protection Engine up to version 1.1.26030.3008.

The second vulnerability, CVE-2026-45498, is a denial-of-service issue with a CVSS score of 4.0. It impacts the Microsoft Defender Antimalware Platform and related products like System Center Endpoint Protection. Successful exploitation could cause Defender or the entire system to become unresponsive, disrupting security...