Microsoft Defender Double Zero-Day: LPE + DoS Actively Exploited in the Wild

Overview

Microsoft has started rolling out patches for two actively exploited zero-day vulnerabilities in Microsoft Defender. Both were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on May 20, with federal agencies ordered to patch within two weeks.

CVE-2026-41091: Link Following LPE

The more severe of the two. An improper link resolution before file access weakness in the Malware Protection Engine allows a standard user to gain SYSTEM privileges.

How It Works

This is a classic link-following attack — the same vulnerability class that’s haunted Windows Defender repeatedly:

1. Attacker (standard user) creates a symbolic link or junction pointing to a privileged filesystem location
2. Defender performs a scan and follows the link with SYSTEM-level privileges
3. The engine writes to or modifies the attacker-controlled destination as SYSTEM
4. Result: Arbitrary file operations with SYSTEM context → full compromise

This is not a new pattern for Defender. BlueHammer (CVE-2026-33825), disclosed earlier this year, was a 7-stage chain exploiting the same link-following behavior through Defender’s RPC + Cloud Files API + VSS workflow. Microsoft keeps patching individual instances while the fundamental architectural problem — Defender operating at SYSTEM level and following user-controlled links — persists.

The Pattern

Microsoft has a systemic Defender link-following problem. Each patch addresses a specific code path, but the engine’s fundamental design — scanning user-accessible paths with SYSTEM privileges and following reparse points — creates an inexhaustible attack surface.

CVE-2026-45498: Platform DoS

The second vulnerability targets the Antimalware Platform (distinct from the scanning engine). Successful exploitation triggers a denial-of-service condition on unpatched Windows devices.

While DoS doesn’t grant direct code execution, the implications are serious:

• Defender goes blind — endpoint loses antivirus protection
• Secondary attacks — malware deployment, lateral movement, and ransomware can proceed unimpeded
• Combined attack chain — DoS the defender (CVE-2026-45498), then escalate privileges (CVE-2026-41091)

The vulnerability affects a wide product range:

• Microsoft Defender Antivirus
• System Center Endpoint Protection (2012, 2012 R2)
• Microsoft Security Essentials

CISA Response

CISA added both vulnerabilities to the KEV catalog on May 20, 2026, ordering Federal Civilian Executive Branch (FCEB) agencies to patch by June 3, 2026 — per Binding Operational Directive 22-01.

“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.”

The two-week deadline (rather than the standard 14-day window for high-severity KEV additions) reflects the active exploitation status and the critical role Defender plays as the default antivirus on every Windows endpoint.

Verification Steps

Microsoft states that auto-updates should handle this — but given active exploitation, verify manually:

1. Open Windows Security
2. Go to Virus & threat protection → Protection Updates
3. Click Check for updates
4. Navigate to Settings → About
5. Verify:
   • Malware Protection Engine ≥ 1.1.26040.8
   • Antimalware Platform ≥ 4.18.26040.7

PowerShell one-liner:

Get-MpComputerStatus | Select-Object AMServiceVersion, AntivirusSignatureVersion, AntimalwarePlatformVersion

The Bigger Picture

Microsoft Defender is the most deployed antivirus on Earth — it runs on every Windows 10/11 machine by default. This makes it both:

1. The highest-value target — compromising Defender gives attackers SYSTEM on virtually every Windows endpoint
2. The hardest problem to fix — the engine must scan untrusted files with high privileges; eliminating link-following bugs across every code path is architecturally difficult

The Chaotic Eclipse disclosure campaign (BlueHammer → UnDefend → YellowKey → GreenPlasma → MiniPlasma) has demonstrated that Defender’s link-following issues are systemic, not sporadic. CVE-2026-41091 is another data point confirming that pattern.

Until Microsoft rearchitects Defender’s file access model to resolve all reparse points in a sandboxed context before performing privileged operations, we will continue to see link-following LPEs in Defender.

TL;DR

• Two Defender zero-days, both actively exploited
• CVE-2026-41091: SYSTEM LPE via link following (patch: engine 1.1.26040.8)
• CVE-2026-45498: DoS disabling Defender (patch: platform 4.18.26040.7)
• CISA KEV with June 3 deadline
• Auto-updates should patch — but verify manually given active exploitation
• This is a recurring pattern, not an isolated incident — Defender keeps getting hit by the same class of vulnerability