Silver Fox fake software installers impersonate Razer and Edge to disable Windows Defender and deploy malware. See how the campaign works.
Related Posts:
PHP Web Server Rootkit Targets F5 BIG-IP Devices
StreamRat Banking Trojan Targets Spanish Android Users
The Gentlemen Ransomware Deploys in Under 24 Hours
The post Silver Fox Fake Software Installers Disable Windows Defender appeared first on Daily CyberSecurity.
A Microsoft Defender false alarm wrongly warns that antivirus is turned off after the latest update. Defender still works, and a fix is coming.
Related Posts:
Windows 11 Relieves OneDrive Nags
Windows 11 KB5120998 Bugs Emerge
Windows 11 26H2 Enters Release Preview Channel
The post Microsoft Defender False Alarm: “Antivirus Is Turned Off” appeared first on Daily CyberSecurity.
SilkParasite APT ran China-nexus cyberespionage across Central Asia, using 7 custom RATs, DLL sideloading, and AI-assisted malware.
Related Posts:
FBI Seizes QScan and QTRouter Platforms Run by China State Hackers
Operation CameraSwarm: 14,500 Dahua Cameras Compromised Across Ukraine and Russia
Core Werewolf Deploys New CoreRAT Malware Against Russian Targets
The post SilkParasite APT Hits Central Asian Governments With 7 RATs appeared first on Daily CyberSecurity.
Microsoft released a patch for the Microsoft Defender scan failure issue. Learn how a flawed update stopped threat services and how to fix this severe error.
Related Posts:
Microsoft Removes Windows 11 Drag Tray
Microsoft Removes WMIC from Default Windows 11 Installs
Windows 11 WinRE Gains Automatic Wi-Fi Reconnection for Cloud Rebuild
The post Microsoft Defender Scan Failure: A Flawed Update appeared first on Daily CyberSecurity.
Microsoft released a patch for the Microsoft Defender scan failure issue. Learn how a flawed update stopped threat services and how to fix this severe error.
Microsoft Defender’s latest patch bypass shows a familiar problem.
A newly disclosed Microsoft Defender flaw called ShieldBreak shows that fixing one attack path doesn’t always close every route to the same result.
Microsoft has assigned ShieldBreak the identifier CVE-2026-69414 and confirmed it is an elevation of privilege (EoP) vulnerability in the Microsoft Malware Protection Engine. Microsoft says it is still working on a security update.
If that sounds somehow familiar, you’re pro
Microsoft Defender’s latest patch bypass shows a familiar problem.
A newly disclosed Microsoft Defender flaw called ShieldBreak shows that fixing one attack path doesn’t always close every route to the same result.
Microsoft has assigned ShieldBreak the identifier CVE-2026-69414 and confirmed it is an elevation of privilege (EoP) vulnerability in the Microsoft Malware Protection Engine. Microsoft says it is still working on a security update.
If that sounds somehow familiar, you’re probably thinking of RoguePlanet, another vulnerability in Defender that Microsoft acknowledged on June 16 and patched on July 8.
A short timeline
At the time, the published exploit for RoguePlanet was described as depending on a race condition, meaning it was not guaranteed to work the same way on every machine. That was one reason the vulnerability was concerning but still somewhat limited from a practical point of view.
Microsoft’s July fix should have closed the door on that problem. But security fixes do not always eliminate a weakness at the root of the problem. Sometimes they block one known attack path, while a researcher later finds a different route to reach the same end result.
That appears to be what happened here. ShieldBreak has been described as a patch bypass because it reportedly sidesteps the earlier RoguePlanet fix, although it uses a different exploitation method rather than simply repeating the original attack.
The advisory says the issue has been publicly disclosed, proof-of-concept (PoC) exploit code exists, exploitation is considered more likely, and no official fix is available yet. Microsoft says it is working on one.
How to stay safe
Until Microsoft releases a fix, the most important protection is preventing untrusted code from running on your computer in the first place. ShieldBreak is a local privilege escalation issue, so an attacker first needs some level of access to the machine.
Based on the best public reporting available right now, ShieldBreak appears to require Microsoft Defender to be enabled in order to work. Public testing indicates that the exploit does not succeed when Defender is off or when another product is registered as the active antivirus provider.
So, narrowly speaking, disabling Defender appears to stop this specific ShieldBreak chain from working. However, that is not a good safety recommendation for most people. Turning off your antivirus removes an important layer of protection and could leave your computer exposed to other attacks.
For home users, all that means:
Install Microsoft’s security updates as soon as they become available.
Be very careful with downloads, email attachments, cracked software, and “fix” tools from random websites.
Keep backups of important files somewhere not directly connected to the PC.
Use an up-to-date, real-time anti-malware solution to alert you about and remove threats from your computer.
“One of the best cybersecurity suites on the planet.”
Microsoft Defender incorrectly isolates VLC plugin caches on Windows 11. Discover how to fix this annoying Microsoft Defender VLC bug and restore playback.
Related Posts:
Microsoft 365 on Windows 10 Enters Feature Freeze as Microsoft Pushes Windows 11 Upgrades
Impending End of Support for Windows 10 LTSC 2021
Windows Control Panel Migration: Why Legacy Code Persists
The post Microsoft Defender Causes VLC Playback Issues appeared first on Daily CyberSecurity.
Microsoft Defender incorrectly isolates VLC plugin caches on Windows 11. Discover how to fix this annoying Microsoft Defender VLC bug and restore playback.
A public PoC named ShieldBreak bypasses Microsoft's CVE-2026-50656 patch, enabling Windows Defender privilege escalation to SYSTEM.
Related Posts:
Zero-Click File Drop Hits Xiaomi ShareMe: PoC Public
CVE-2026-65640: WordPress 7.0.4 Fixes Remote Code Execution
MariaDB Low-Privilege Remote Code Execution Chain: Full Details and PoC Exploit Code Publicly Disclosed
The post CVE-2026-50656 PoC Published: Defender Privilege Escalation Bypass appeared first on Daily CyberSecurity.
Chaotic Eclipse released a PoC for ShieldBreak, a Microsoft Defender zero-day that bypasses the CVE-2026-50656 patch and could enable SYSTEM-level code execution.
Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a PoC for ShieldBreak, a Microsoft Defender zero-day. The flaw bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition that can allow attackers to spawn a SYSTEM-level shell. Successful exploitation could
Chaotic Eclipse released a PoC for ShieldBreak, a Microsoft Defender zero-day that bypasses the CVE-2026-50656 patch and could enable SYSTEM-level code execution.
Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a PoC for ShieldBreak, a Microsoft Defender zero-day. The flaw bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition that can allow attackers to spawn a SYSTEM-level shell. Successful exploitation could enable arbitrary code execution and other unauthorized actions on affected Windows systems.
“Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass.” said Chaotic Eclipse. “The PoC was tested in the latest version of windows 11 25h2 (+Canary channel) and windows server 2025, the PoC also have a 100% success rate. Please note that Windows 10 (and respective server editions) are not currently supported, they are however vulnerable to ShieldBreak as well.”
In early July, Microsoft released security updates for RoguePlanet, a vulnerability tracked as CVE-2026-50656 (CVSS score of 7.8) affecting the Malware Protection Engine used by Defender. The Microsoft Malware Protection Engine (mpengine.dll) powers Defender’s malware scanning, detection, and removal functions.
The flaw is a local privilege escalation issue that could allow an attacker with access to a system to obtain higher privileges and potentially compromise security controls.
In mid-June, Microsoft acknowledged the RoguePlanet zero-day affecting Microsoft Defender and stated it is aware of the issue and was actively developing a security update to address the flaw and protect affected systems.
A week before, the security researcher Chaotic Eclipse published a new proof-of-concept exploit for a RoguePlanet. The flaw relies on a race condition that can provide attackers with SYSTEM-level privileges, allowing them to execute code with the highest permissions. The exploit was successfully tested on fully updated Windows 10 and Windows 11 systems running the June 2026 Patch Tuesday updates, showing that patched systems may still be vulnerable.
Now Chaotic Eclipse claims ShieldBreak fully bypasses Microsoft’s CVE-2026-50656 patch, while Defender may also leak 8 bytes of data under certain conditions.
The researcher tested the PoC on Windows 11 25H2 and Windows Server 2025 with a 100% success rate. Windows 10 is also vulnerable, though not currently supported by the PoC.
In May, the researcher disclosed two other Windows zero-day vulnerabilities named YellowKey and GreenPlasma. The flaws affect BitLocker and the Windows Collaborative Translation Framework (CTFMON). YellowKey could allow attackers to bypass BitLocker protections, while GreenPlasma enables privilege escalation. The researcher previously disclosed three Microsoft Defender vulnerabilities.
The researcher criticized Microsoft for revoking access to their MSRC account, rejecting reports, and failing to provide compensation.
At the end of May, Microsoft’s Security Response Center called the zero-day dumps irresponsible.
“In recent weeks several zero-day vulnerabilities have been publicly disclosed.” reads the report published by Microsoft. “The details of these vulnerabilities were not shared with Microsoft prior to release, and the disclosures put our customers at unnecessary risk.”
The company said its security teams have been working around the clock since the disclosures to understand the impact, build patches, and protect customers from attackers who picked up the published exploit code and ran with it.
Microsoft’s post is essentially a public defense of Coordinated Vulnerability Disclosure, the standard practice where a researcher notifies a vendor privately, gives them time to fix the issue, and then goes public. Microsoft says it works with hundreds of researchers this way every year, compensating them through bug bounty programs and crediting them publicly.
“This partnership allows us to make updates to impacted services before proof-of-concept code can make it into the hands of bad actors.” continues the report. “The vulnerabilities known as RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma were not responsibly disclosed.”
The implication is clear: when someone skips that step, real people get attacked with real tools built from the published research.
In July, just hours after Microsoft’s July 2026 Patch Tuesday, Chaotic Eclipse, published a new Windows zero-day proof-of-concept called LegacyHive. This time, the target is the Windows User Profile Service (ProfSvc), and unlike the hundreds of vulnerabilities Microsoft fixed this month, this one currently has no CVE, no advisory, and no security update.
LegacyHive is a local privilege escalation vulnerability. An attacker who already has code execution as a standard user can abuse the User Profile Service to load another user’s registry hive, potentially that of a local administrator, under their own profile.
At the end of May, Microsoft’s Security Response Center called the zero-day dumps irresponsible.
“In recent weeks several zero-day vulnerabilities have been publicly disclosed.” reads the report published by Microsoft. “The details of these vulnerabilities were not shared with Microsoft prior to release, and the disclosures put our customers at unnecessary risk.”
The company said its security teams have been working around the clock since the disclosures to understand the impact, build patches, and protect customers from attackers who picked up the published exploit code and ran with it.
Microsoft’s post is essentially a public defense of Coordinated Vulnerability Disclosure, the standard practice where a researcher notifies a vendor privately, gives them time to fix the issue, and then goes public. Microsoft says it works with hundreds of researchers this way every year, compensating them through bug bounty programs and crediting them publicly.
“This partnership allows us to make updates to impacted services before proof-of-concept code can make it into the hands of bad actors.” continues the report. “The vulnerabilities known as RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma were not responsibly disclosed.”
The implication is clear: when someone skips that step, real people get attacked with real tools built from the published research.
Fake downloads of The Odyssey are spreading Lumma Stealer malware capable of stealing passwords, cookies, payment data, and cryptocurrency information.
The post Fake The Odyssey Downloads Are Hiding Password-Stealing Malware appeared first on TechRepublic.
Fake downloads of The Odyssey are spreading Lumma Stealer malware capable of stealing passwords, cookies, payment data, and cryptocurrency information.
Microsoft is retiring its legacy Threat Intelligence portal on August 1. Security teams should verify licenses, permissions, investigation projects, APIs, and automated workflows before the cutoff.
The post Microsoft Threat Intelligence Portal Retires in August: 4 Checks Before the Cutoff appeared first on TechRepublic.
Microsoft is retiring its legacy Threat Intelligence portal on August 1. Security teams should verify licenses, permissions, investigation projects, APIs, and automated workflows before the cutoff.
Learn how BitLocker, passkeys, Microsoft Defender, and other Windows 11 security features protect your data, accounts, apps, and devices.
The post Windows 11 Security Cheat Sheet: BitLocker, Passkeys, and Defender Explained appeared first on TechRepublic.
Microsoft issued a security update that fixes the zero-day vulnerability known as RoguePlanet in Microsoft Defender.
RoguePlanet is tracked as CVE-2026-50656, a Microsoft Defender elevation of privilege (EoP) vulnerability. As we reported last month, if successfully exploited, RoguePlanet can allow an attacker to elevate privileges from a standard user account to NT AUTHORITY\SYSTEM, the highest privilege level on Windows.
This means an attacker who gains access to a standard user account
Microsoft issued a security update that fixes the zero-day vulnerability known as RoguePlanet in Microsoft Defender.
RoguePlanet is tracked as CVE-2026-50656, a Microsoft Defender elevation of privilege (EoP) vulnerability. As we reported last month, if successfully exploited, RoguePlanet can allow an attacker to elevate privileges from a standard user account to NT AUTHORITY\SYSTEM, the highest privilege level on Windows.
This means an attacker who gains access to a standard user account on your computer could use the vulnerability to take complete control of the system. They don’t need advanced hacking skills or administrator permissions to do this.
If Windows Security shows that another antivirus, such as Malwarebytes, is protecting your PC and Microsoft Defender Antivirus is turned off (as shown below), this particular vulnerability does not affect your system. Defender’s scanning engine isn’t running, so it can’t be exploited through this flaw.
If you’re running another antivirus and Defender is turned off, there’s nothing to worry about
Most users are already protected
By default, Microsoft Defender automatically updates both its malware definitions and the Microsoft Malware Protection Engine.
But if you’re in any doubt, you can check the version of the Malware Protection Engine on your system. Here’s how:
Click the Start button, type Security, and choose Windows Security from the results.
Select Virus & threat protection, then under Virus & threat protection updates, click Check for updates.
Click Settings (the cog icon) then select About.
Look for a line called Engine Version. That number is the version of the Malware Protection Engine used by Microsoft Defender.
If your Engine Version is 1.1.26060.3008 or higher, your system has the patched (or newer) engine.
If your Engine Version is 1.1.26050.11 or lower, your system is still running a vulnerable engine. Run Windows Update and check for Defender updates again, or wait for the automatic update to complete.
Note: Version numbers are compared from left to right. For example, 1.1.26060.3008 is newer than 1.1.26050.11 because 26060 is higher than 26050.
If you use Windows Defender, leave automatic updates turned on. The Malware Protection Engine normally updates automatically, so most home users will receive the fix without doing anything. These steps are simply a way to double-check your system has the updated engine.
We don’t just report on threats—we remove them
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Make Windows 11 feel faster with nine cleanup tips for startup apps, storage, background processes, updates, malware scans, and more.
The post Windows 11 Cleanup Guide: 9 Ways to Make Your PC Feel Faster appeared first on TechRepublic.
Bitdefender Antivirus Plus protects one PC for a full year with no monthly fees, and it even comes with a VPN.
The post 1 Year of This Popular Antivirus is on Sale for $20 appeared first on TechRepublic.
A publicly available exploit called RoguePlanet can give attackers the highest level of access on Windows systems. Microsoft has confirmed the vulnerability and says it’s working on a security update.
RoguePlanet is tracked under CVE-2026-50656, where it’s described as a Microsoft Defender Elevation of Privilege (EoP) vulnerability.
In its advisory, Microsoft says:
“Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly
A publicly available exploit called RoguePlanet can give attackers the highest level of access on Windows systems. Microsoft has confirmed the vulnerability and says it’s working on a security update.
RoguePlanet is tracked under CVE-2026-50656, where it’s described as a Microsoft Defender Elevation of Privilege (EoP) vulnerability.
In its advisory, Microsoft says:
“Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as “RoguePlanet “. We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the update is available.”
If successfully exploited, RoguePlanet can allow an attacker to elevate privileges from a standard user account to NT AUTHORITY\SYSTEM, the highest privilege level on Windows.
This means an attacker who manages to get access to a standard user account on your computer could use the vulnerability to gain complete control of the system. They don’t need advanced hacking skills or administrator permission to do this.
The success of the published exploit does depend on a race condition, though. This means its success depends on the precise timing of two events. The researcher wrote:
“I have managed to get a 100% success rate on some machines while it struggled to work on others.”
It seems that the problem lies in a high-level part of the Microsoft Defender code, which may help to explain why Microsoft says it’s working on a “high quality security update.”
This same researcher has submitted three earlier Microsoft Defender vulnerabilities known as BlueHammer (CVE-2026-33825), UnDefend (CVE-2026-45498), and RedSun (CVE-2026-41091), as well as four other Windows zero-days, all of which have since been patched by Microsoft.
How to protect your machine
The exploit reportedly works whether you’re using active protection or not, so disabling Microsoft Defender is not a solution. But there are a few things you can do to protect your machine:
Look out for a Microsoft security update addressing this vulnerability and install it as soon as it becomes available.
Back up your important data on a platform or device that is not directly connected to your computer.
Be careful about downloading executable files from unknown sources or running files that are recommended to you without you asking for them.
Do not rely on Microsoft Defender as your only anti-malware solution. Malwarebytes detects RoguePlanet.exe (the exploit code) based on its behavior.
Obviously, we’ll keep you posted about this and other security issues, so stay tuned.
“One of the best cybersecurity suites on the planet.”
A new Windows zero-day reportedly bypasses BitLocker, adding pressure on Microsoft as researchers debate the exploit’s real-world impact.
The post New Windows Zero-Day Claims BitLocker Bypass Amid Microsoft Disclosure Fight appeared first on TechRepublic.
Last week on Malwarebytes Labs:
Update Chrome now: Critical bugs could let attackers run code
Microsoft Defender vulnerabilities are being exploited in the wild
TikTok, YouTube, and Roblox face scrutiny, but age gates won’t fix child safety
Catch spyware in the act with Windows Webcam Monitoring
Researchers left AI agents alone in a virtual town and watched it all unravel
Fake malware-signing service Fox Tempest dismantled by Microsoft
Firefox 151 packs big privacy upgrades
Microsoft has confirmed active exploitation of two security vulnerabilities in its security ecosystem, identified as CVE-2026-41091 and CVE-2026-45498, both evaluated under the CVSS scoring system. The issues affect Microsoft Defender and have raised concerns due to confirmed in-the-wild exploitation and potential impact on enterprise systems.
The first issue, CVE-2026-41091 (CVSS 7.8), is a privilege escalation vulnerability affecting Microsoft Defender. If successfully exploited, it could
Microsoft has confirmed active exploitation of two security vulnerabilities in its security ecosystem, identified as CVE-2026-41091 and CVE-2026-45498, both evaluated under the CVSS scoring system. The issues affect Microsoft Defender and have raised concerns due to confirmed in-the-wild exploitation and potential impact on enterprise systems.The first issue, CVE-2026-41091 (CVSS 7.8), is a privilege escalation vulnerability affecting Microsoft Defender. If successfully exploited, it could allow a local attacker to obtain SYSTEM-level privileges. The flaw is rooted in improper link resolution before file access, commonly described as a “link following” issue.Microsoft stated in its advisory:"Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally,"The second vulnerability, CVE-2026-45498 (CVSS 4.0), is a denial-of-service flaw impacting Microsoft Defender. While rated lower in severity under the CVSS framework, it has still been confirmed as actively exploited in real-world environments alongside CVE-2026-41091.Both vulnerabilities have been addressed in updated releases of the Microsoft Defender Antimalware Platform, specifically versions 1.1.26040.8 and 4.18.26040.7, respectively.
CVE-2026-41091, CVE-2026-45498, and CVSS Context
Although Microsoft has not explicitly confirmed the link, the behavior associated with CVE-2026-41091 and CVE-2026-45498 overlaps with earlier publicly discussed issues named RedSun and UnDefend, which were disclosed by the threat research group Chaotic Eclipse (also known as Nightmare-Eclipse).Security researchers from Huntress have reported active exploitation of both CVE-2026-41091 and CVE-2026-45498 in the wild. These observations also include exploitationactivity related to BlueHammer (CVE-2026-33825), suggesting a broader campaign targeting Microsoft Defender components and adjacent security mechanisms.
Additional Security Findings
Alongside the two actively exploited vulnerabilities CVE-2026-41091 and CVE-2026-45498, Microsoft also patched another flaw in the same Defender update cycle: CVE-2026-45584 (CVSS 8.1). This vulnerability is a heap-based buffer overflow that could allow remote code execution if exploited. Unlike CVE-2026-41091 and CVE-2026-45498, there is currently no evidence that CVE-2026-45584 has been used in active attacks.Microsoft Defender systems that have been disabled are not affected by these vulnerabilities, according to the company. Microsoft also noted that no manual intervention is required for most users, as updates are delivered automatically through malware definition updates and the Microsoft Malware Protection Engine.
CVSS Updates and Security Guidance
To verify protection status against CVE-2026-41091 and CVE-2026-45498, Microsoft recommends users check their Microsoft Defender configuration using the Windows Security interface (Microsoft Windows Security). The recommended steps include navigating to Virus & threat protection, checking protection updates, and verifying the Antimalware Client Version.Microsoft credited five researchers for identifying CVE-2026-41091, including Sibusiso, Diffract, Andrew C. Dorman (also known as ACD421), Damir Moldovanov, and an anonymous contributor.
CISA KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) (Cybersecurity and Infrastructure Security Agency) has added both CVE-2026-41091 and CVE-2026-45498 to its Known Exploited Vulnerabilities (KEV) catalog. Federal Civilian Executive Branch (FCEB) agencies are required to apply mitigations by June 3, 2026, reflecting the urgency of addressing CVSS-rated threats that are already being exploited.With this addition, three Microsoft vulnerabilities have been flagged as actively exploited within a single week, highlighting a concentrated wave of CVE-based attacks targeting Microsoft products.
Legacy Vulnerabilities
CISA’s KEV catalog update also included several older but still relevant vulnerabilities:
CVE-2010-0806: Internet Explorer use-after-free flaw enabling remote code execution
CVE-2010-0249: Another Internet Explorer use-after-free vulnerability allowing arbitrary code execution
CVE-2009-1537: DirectX issue in QuickTime Movie Parser Filter via crafted media files
CVE-2008-4250: Windows Server Service buffer overflow via crafted RPC request
CVE-2009-3459: Adobe Acrobat and Reader heap-based buffer overflow via malicious PDF files
These legacy issues demonstrate that exploitation of older software remains relevant in modern threat landscapes, especially when combined with newer vulnerabilities like CVE-2026-41091 and CVE-2026-45498, both evaluated using CVSS metrics.
Two Microsoft Defender vulnerabilities are being actively exploited in the wild.
On May 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added a notable set of actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The KEV catalog tracks vulnerabilities known to be exploited in the wild and sets patch deadlines for Federal Civilian Executive Branch (FCEB) agencies.
Five of the added vulnerabilities are quite old by vulnerability standa
Two Microsoft Defender vulnerabilities are being actively exploited in the wild.
On May 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added a notable set of actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The KEV catalog tracks vulnerabilities known to be exploited in the wild and sets patch deadlines for Federal Civilian Executive Branch (FCEB) agencies.
Five of the added vulnerabilities are quite old by vulnerability standards. Patches were released in 2008, 2009, and 2010. But the Microsoft Defender vulnerabilities are from this year. Those two are:
CVE‑2026‑41091 (CVSS score 7.8 out of 10): a Microsoft Defender elevation of privilege vulnerability. A local attacker who already has some access to a machine can abuse Defender to gain SYSTEM‑level permissions, effectively giving them full control over Windows.
CVE‑2026‑45498 (CVSS score 4.0 out of 10): a Microsoft Defender denial‑of‑service vulnerability. Here, an attacker can interfere with Defender in a way that disrupts its normal operation. If attackers can crash or disable your antivirus engine on demand, they can create a safer environment for their malware to run undetected.
You should take patching these vulnerabilities seriously if:
You rely on Microsoft Defender as your primary endpoint protection
You manage Windows systems in a business, school, or local government environment
You have shared machines, terminal servers, or any environment where multiple users log on to the same system
As you’d expect from us, we don’t advise relying on Windows Defender alone. There are better options available, and they are not mutually exclusive.
How to patch
Security products are software, and software has bugs. When those bugs end up in a list of known exploited vulnerabilities, ignoring them is like leaving your front door open because “the alarm will catch anyone coming in.”
Make sure Windows Update is enabled and set to receive updates for Microsoft products. Defender platform updates are often delivered alongside regular cumulative updates.
Also check that recent Microsoft Defender security intelligence and platform updates are installed.
The first version of the Microsoft Defender Antimalware Platform with these vulnerabilities addressed is 4.18.26040.7.
You can usually find that version number in Windows Security:
Open Start and search for Windows Security
Go to Virus & threat protection
Click Settings or the gear icon
Open About
Even with auto-update enabled, I didn’t receive this patch immediately. Defender platform updates can lag behind definitions or only appear when a cumulative Windows update lands. Microsoft typically releases updates for the Microsoft Defender Antimalware Platform once a month, or as needed to protect against new threats.
So, I’ll have to wait. Good thing I’m protected.
We don’t just report on threats—we remove them
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
What happened A faulty Microsoft Defender antimalware signature update released around April 30, 2026, caused widespread false positive alerts by incorrectly flagging two legitimate DigiCert root certificates as high-severity malware. The detection, labeled Trojan:Win32/Cerdigent.A!dha, identified registry entries belonging to DigiCert Assured ID Root CA and DigiCert Trusted Root G4 as threats and automatically quarantined them […]
The post Microsoft Defender Mistakenly Flags DigiCert Root Certi
What happened A faulty Microsoft Defender antimalware signature update released around April 30, 2026, caused widespread false positive alerts by incorrectly flagging two legitimate DigiCert root certificates as high-severity malware. The detection, labeled Trojan:Win32/Cerdigent.A!dha, identified registry entries belonging to DigiCert Assured ID Root CA and DigiCert Trusted Root G4 as threats and automatically quarantined them […]
Entrar
