Microsoft Warns of Two Actively Exploited Defender Vulnerabilities

Microsoft Windows contains a buffer overflow in the Windows Server Service that is triggered when a specially crafted RPC request causes an overflow during path canonicalization. A remote attacker who can reach the service (historically over SMB) can send such a request and execute arbitrary code on the target system. Any Microsoft Windows system running the Server Service is affected, with exposure concentrated on legacy or unpatched machines whose RPC/SMB interface is reachable from untrusted networks. CISA added the flaw (CVE-2008-4250, the vulnerability addressed by Microsoft's 2008 MS08-067 bulletin) to its Known Exploited Vulnerabilities catalog on 2026-05-20, confirming exploitation in the wild, with no ransomware association yet documented. Its EPSS score of 98.8% (100th percentile) indicates a very high likelihood of continued exploitation over the next 30 days.

Do: Confirm that every Windows host has the Server Service fix from Microsoft bulletin MS08-067 (released October 2008) or a later Windows update, prioritizing internet-facing and legacy systems that may never have been patched. Restrict inbound SMB/RPC (TCP 445) to trusted networks, disable the Server Service where it is not required, and hunt for indicators of compromise on unpatched hosts. Federal agencies must apply mitigations per vendor instructions and applicable BOD 22-01 guidance, or discontinue use of the product if mitigations are unavailable, per the KEV required action.

CVE-2009-1537 is a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter inside quartz.dll, a DirectShow component of Microsoft DirectX. It is triggered when the affected DirectShow component parses a crafted QuickTime (.mov) media file, such as one opened from a website, media player, or email. A successful exploit allows a remote attacker to execute arbitrary code on the targeted system. Any Microsoft installation with the vulnerable DirectX/DirectShow component is affected, with real-world risk concentrated on systems that render untrusted QuickTime media. The flaw is long-standing (2009) but CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-20, confirming active exploitation; EPSS puts its 30-day exploitation probability at 51.2% (99th percentile), while no public PoC is known and ransomware use is unconfirmed.

Do: Apply Microsoft's mitigations per vendor instructions, and follow BOD 22-01 requirements for cloud services in federal environments; ensure affected systems have the vendor's updated quartz.dll/DirectShow fix installed rather than relying on default installations. Until patched, avoid opening untrusted QuickTime (.mov) files and block or inspect .mov files delivered via email and web downloads. Treat this as a high priority given the KEV listing and elevated EPSS score, even though ransomware association is not yet confirmed.

Adobe Acrobat and Reader contain a heap-based buffer overflow (CWE-119) in the processing of PDF content that corrupts process memory. The flaw is triggered remotely when a user opens a specially crafted PDF file, requiring no authentication and only that the victim open or view the malicious document. Successful exploitation allows an attacker to execute arbitrary code on the victim's system with the privileges of the user running Acrobat or Reader. Anyone running an affected version of Adobe Acrobat or Reader is exposed, and because these PDF clients are near-ubiquitous on desktops, the potential affected population is very large. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-05-20, confirming active exploitation in the wild; EPSS assigns an 86.6% probability of exploitation within 30 days, while no public proof-of-concept is known and ransomware use has not been confirmed.

Do: Inventory systems running Adobe Acrobat or Reader and upgrade to a patched version per Adobe's security advisory immediately, since the KEV listing invokes BOD 22-01 timelines for federal agencies. Until patched, filter or sandbox untrusted PDFs at email gateways and consider disabling PDF JavaScript in Reader where supported, a standard Adobe mitigation for this class of flaw. Verify installed versions against the vendor's affected-version list and monitor CISA and vendor advisories for updated indicators, noting ransomware use remains unconfirmed.

Microsoft Internet Explorer contains a use-after-free flaw (CWE-416) in which the browser accesses a pointer to an object that has already been deleted, a defect historically associated with the January 2010 'Aurora' targeted attacks. The flaw is triggered when a user simply visits an attacker-crafted or attacker-controlled web page that forces the browser to free an in-use object and then dereference the dangling pointer during page rendering. Successful exploitation gives a remote attacker the ability to execute arbitrary code in the security context of the logged-on user, potentially installing programs; viewing, changing, or deleting data; or creating new accounts. Anyone running Internet Explorer is affected, especially organizations still relying on the now end-of-life/end-of-service browser on legacy Windows systems, which CISA says should discontinue use if mitigations are not applied. Exploitation is confirmed: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-05-20 and EPSS assigns a 91.9% probability of exploitation within 30 days (100th percentile), although no public proof-of-concept is cataloged.

Do: Per CISA's KEV required action, apply Microsoft's mitigations: the January 2010 out-of-band cumulative security update for Internet Explorer (MS10-002) remediates this flaw, with workarounds including disabling Active Scripting or setting the Internet and Local intranet security zones to High. Inventory any systems still invoking Internet Explorer (legacy Windows builds and intranet apps) and migrate them to Microsoft Edge or another supported browser, discontinuing IE use entirely where mitigations are unavailable.

Microsoft Internet Explorer contains a use-after-free (resource management) flaw in which the browser accesses an invalid pointer after an object has been deleted, leaving a dangling pointer. A remote attacker can trigger the flaw by luring a user of a vulnerable Internet Explorer version to attacker-controlled or malicious web content; the dangling-pointer access can be leveraged to execute arbitrary code with the victim user's privileges. Any system still running the affected Internet Explorer builds is exposed; the flaw dates to the 2010 era, when vendor advisories (cumulative update MS10-018, March 2010) addressed it in Internet Explorer 6 and 7, and CISA notes the impacted product may be end-of-life. Exploitation is confirmed in the wild: the flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2026-05-20 (ransomware use unknown), and EPSS assigns an 82.2% probability of exploitation within 30 days; no public proof-of-concept is cataloged.

Do: Apply mitigations per Microsoft's vendor instructions within the BOD 22-01 timeframe, which for affected builds means the MS10-018 (March 2010) cumulative Internet Explorer update; because IE 6/7 (and IE generally) are end-of-life/retired, CISA also permits discontinuing use of the product. Inventory the estate for Internet Explorer 6/7 on legacy Windows XP and embedded or unmanaged systems, and migrate any remaining users to a supported, currently patched browser rather than relying on the retired IE client.

CVE-2026-33825 is an insufficient granularity of access control flaw (CWE-1220) in Microsoft Defender Antimalware Platform that allows an authorized attacker to elevate privileges locally. It is triggered by an attacker who already holds a low-privileged foothold on a machine running Defender, with no user interaction required. Successful exploitation has high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8), granting elevated local rights that facilitate defense evasion, persistence, or ransomware activity. Any organization running Microsoft Defender on Windows endpoints and servers is potentially affected. The flaw is actively exploited in the wild, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-04-22 with ransomware use confirmed, and is one of three Microsoft Defender zero-days reported as exploited, two of which were still unpatched at the time of reporting.

Do: Apply Microsoft's April 2026 Patch Tuesday updates for the Defender Antimalware Platform (platform/security intelligence updates) per vendor instructions, consistent with CISA BOD 22-01 timelines for KEV entries, and note reports that two of the three exploited Defender zero-days were still unpatched, so monitor for follow-up fixes. Prioritize patching internet-reachable and high-value Windows hosts, and hunt for signs of local privilege escalation and ransomware precursor activity on systems that cannot be updated immediately.

CVE-2026-45498 is a denial-of-service flaw (CWE-400, uncontrolled resource consumption) in the Microsoft Defender antimalware platform, rated 7.5 (High) with a network attack vector and no privileges or user interaction required. A remote, unauthenticated attacker can trigger excessive resource consumption that disrupts the Defender service, with high impact on availability but no confidentiality or integrity impact per the CVSS scoring. An attacker gains the ability to crash, hang, or disable antimalware protection on targeted systems, potentially leaving endpoints temporarily unprotected. Any deployment of Microsoft Defender — which is the default antimalware on modern Windows and is also deployed as a cloud service — is in scope, and CISA's required action explicitly points defenders to BOD 22-01 guidance for cloud services. The flaw has been added to CISA's KEV catalog (2026-05-20), EPSS assigns it a 63.1% probability of exploitation within 30 days, and headlines confirm it is being exploited in the wild alongside CVE-2026-41091.

Do: Apply mitigations per Microsoft's vendor instructions and follow applicable CISA BOD 22-01 guidance for cloud services, as required by the KEV entry. Ensure the Defender antimalware platform and its security intelligence updates are fully current on all endpoints, and check event logs for Defender service crashes or disabled protection that may indicate exploitation. Ransomware use is currently listed as unknown, so treat any Defender outage on exposed systems as a potential precursor to follow-on activity.

CVE-2026-42897 is an improper-neutralization flaw (CWE-79) in Microsoft Exchange Server that lets an unauthenticated remote attacker perform cross-site scripting and carry out spoofing. Per the CVSS vector (AV:N/PR:N/UI:R), exploitation requires a victim to interact with attacker-controlled content — reported attacks by the Russian actor Laundry Bear (TA488) trigger when a crafted email is opened in Exchange's webmail interface (Outlook Web Access). The attacker gains the ability to spoof the victim within their webmail session, and reported intrusions show mailbox access persisting even after organizations rotate credentials. Any organization running on-premises Microsoft Exchange Server or Exchange Server Subscription Edition is potentially exposed, particularly those publishing webmail to the internet; specific affected version ranges are not provided in the available data. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2026-05-15 and carries a very high EPSS score of 71.2%, though no public proof-of-concept is known.

Do: Apply Microsoft's security update for CVE-2024-42897 to all on-premises Exchange and Exchange Subscription Edition servers per vendor guidance — no specific patch versions are provided in the available data, so consult the vendor advisory for build numbers. Federal agencies must patch or apply mitigations per BOD 22-01 given the KEV listing. Because reported attacks (Laundry Bear/TA488) maintain mailbox access after password resets, treat any suspected compromise as persistent: review OWA access logs and inbox rules for anomalies, and invalidate active webmail sessions and tokens, not just credentials.

Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.