Your Antivirus Was the Target: What the Microsoft Defender Zero-Day Means for You
Security Advisory
Most cyberattacks try to sneak past your security tools. These ones went straight at them.
On May 21, 2026, Microsoft released emergency patches for two vulnerabilities in Windows Defender - the built-in antivirus protection that ships on virtually every Windows computer. The two flaws are tracked as CVE-2026-41091 and CVE-2026-45498.
What makes this situation particularly serious is that both were already being actively used by real attackers before any fix was available, and one of them could silently disable your antivirus protection without showing any warning to you or your IT team. If your organization runs Windows and utilizes Microsoft Defender, this warrants immediate attention.
What the Attackers Were Doing
The first vulnerability, CVE-2026-41091, carries a CVSS severity score of 7.8 out of 10 - a rating that security professionals classify as “high.” It allowed someone with even limited access to a Windows machine - say, a low-level employee account or a compromised login - to instantly gain the highest level of control over that computer, equivalent to full administrator access.
The second vulnerability, CVE-2026-45498 (CVSS 4.0), was used to quietly disable Defender in the background, leaving the machine unprotected while appearing normal on security dashboards.
In at least one documented real-world attack, a threat actor used a stolen VPN login to get inside a network, ran a quick sweep to understand what they had access to, and then deployed both CVEs in sequence - first using CVE-2026-45498 to disable the antivirus, then CVE-2026-41091 to seize full control of the machine. The security firm Huntress, which investigated the intrusion, had to isolate the affected organization to stop the breach from spreading further.
Why the Exposure Window Matters
These vulnerabilities existed in the open - without a patch - for roughly six weeks. A security researcher had publicly released the underlying exploit code in early April after a disagreement with Microsoft over how security reports are handled.
That is an unusually long window of exposure, and it is why the U.S. Cybersecurity and Infrastructure Security Agency (CISA) took the step of formally adding both CVEs to its Known Exploited Vulnerabilities catalog and ordering all federal government agencies to confirm the fixes are applied by June 3, 2026.
For everyone outside the federal government, that same deadline is a reasonable benchmark for your own teams.
A third vulnerability, CVE-2026-45584 (CVSS 8.1), was also quietly patched in the same update - a remote code execution flaw in the same Defender engine that, while not yet confirmed in active attacks, carries an even higher severity rating and should not be overlooked.
What to Verify Now
The good news is that Microsoft delivers these fixes automatically through Defender’s built-in update system - most users and organizations do not need to manually download anything.
The important caveat is that automatic availability is different from confirmed installation. Machines that have delayed update policies, systems managed through corporate IT infrastructure that have not yet approved the release, or computers that have simply been offline can all still be sitting exposed.
If you manage a team or organization, now is the time to verify - not assume. Ask your IT team to confirm that the Malware Protection Engine is at version 1.1.26040.8 or higher, and the Antimalware Platform is at 4.18.26040.7 or higher.
If you are an individual user, open Windows Security, go to Virus & threat protection, and run a manual check for Protection Updates.
The Broader Lesson
Security software itself is not immune to attack. When CVE-2026-41091 and CVE-2026-45498 are chained together, the machine loses its ability to detect anything else happening to it - and that is not a theoretical risk anymore. It played out on real networks in April and May of this year.
Knowing your CVE exposure, understanding the CVSS severity ratings, and verifying that your defenses are functioning and up to date are not IT formalities. They are the baseline.
Advisory Summary
- CVE-2026-41091 - Privilege Escalation | CVSS 7.8 (High)
- CVE-2026-45498 - Denial of Service / Antivirus Disablement | CVSS 4.0 (Medium)
- CVE-2026-45584 - Remote Code Execution | CVSS 8.1 (High)
- Patches released May 21, 2026 - delivered automatically via Windows Update
- CISA federal remediation deadline: June 3, 2026
- Action required: Confirm your Defender version is current. Contact your IT team if you are unsure.
References
Scott Morgan
Senior Director of Cyber Strategy