Microsoft this week released patches for two vulnerabilities in Defender, warning they have been exploited in the wild as zero-days.
The first, tracked as CVE-2026-41091 (CVSS score of 7.8), is described as a link-following issue that allows attackers to elevate their privileges to System.
“Improper link resolution before file access (‘link following’) in Microsoft Defender allows an authorized attacker to elevate privileges locally,” Microsoft notes in its bare-bones advisory.
The second bug, tracked as CVE-2026-45498 (CVSS score of 4.0), is a denial-of-service (DoS) flaw.
Microsoft addressed the two security defects in Microsoft Defender Antimalware Platform version 4.18.26040.7. According to the company, systems with Microsoft Defender disabled are not exploitable, even though Defender’s files remain on disk.
