Microsoft this week released patches for two vulnerabilities in Defender, warning they have been exploited in the wild as zero-days.
The first, tracked as CVE-2026-41091 (CVSS score of 7.8), is described as a link-following issue that allows attackers to elevate their privileges to System.
“Improper link resolution before file access (‘link following’) in Microsoft Defender allows an authorized attacker to elevate privileges locally,” Microsoft notes in its bare-bones advisory.
The second bug, tracked as CVE-2026-45498 (CVSS score of 4.0), is a denial-of-service (DoS) flaw.
Microsoft addressed the two security defects in Microsoft Defender Antimalware Platform version 4.18.26040.7. According to the company, systems with Microsoft Defender disabled are not exploitable, even though Defender’s files remain on disk.
The company warned that both vulnerabilities have been publicly disclosed and that in-the-wild exploitation was detected, but did not provide further details.
According to a post by Microsoft MVP Fabian Bader, the two vulnerabilities are the RedSun and UnDefend variants of the BlueHammer exploit that security researcher Chaos Eclipse dropped publicly last month. BlueHammer has also been exploited in the wild.
On Wednesday, the US cybersecurity agency CISA added both flaws to its Known Exploited Vulnerabilities (KEV) list, urging federal agencies to patch them by June 3.
The fresh Defender bugs were added to CISA’s KEV list alongside five other issues, all disclosed over half a decade ago.
The oldest of the five is CVE-2008-4250, a remote code execution (RCE) weakness in the Server service of older Windows iterations that can be exploited via crafted RPC requests.
Next in line is CVE-2009-1537, a NULL byte overwrite issue in Microsoft DirectX that could be exploited for RCE via crafted QuickTime media files. It was flagged as exploited in the wild in May 2009.
The third vulnerability newly added to the KEV catalog is CVE-2009-3459, a heap-based buffer overflow in Adobe Acrobat and Reader that can be exploited for RCE via crafted PDF files.
Additionally, CISA warned of the in-the-wild exploitation of two use-after-free vulnerabilities in Internet Explorer (CVE-2010-0249 and CVE-2010-0806).
Federal agencies have until June 3 to apply patches for all these security defects. All organizations are advised to review CISA’s KEV list and address the vulnerabilities in it as soon as possible.
Related: Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector
Related: Researcher Drops MiniPlasma Windows Exploit for Unpatched 2020 CVE
Related: Exploitation of Critical NGINX Vulnerability Begins
Related: Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild
