Microsoft Defender vulnerabilities exploited in the wild (CVE-2026-41091, CVE-2026-45498)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-33825 | Local Privilege Escalation in Microsoft Defender Antimalware Platform | 7.8 | 7% | KEVRansomwarePoC | KEV |
CVE-2026-45498+1 related CVE | Denial-of-Service Vulnerability in Microsoft Defender Antimalware Platform | 7.5 group max | 63% | KEV | KEV |
| CVE-2026-45584 | Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network | 8.1 | <1% | ||
| CVE-2026-45585 | Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey" | 6.8 | 2% | PoC ×4 |
From the original article
2 min read at helpnetsecurity.com
Attackers are exploiting two Microsoft Defender vulnerabilities (CVE-2026-41091 and CVE-2026-45498), Microsoft acknowledged and CISA confirmed by adding them to its Known Exploited Vulnerabilities catalog. CVE-2026-41091 allows for local privilege elevation (LPE), and is caused by the Microsoft Malware Protection Engine improperly resolving links before accessing files.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.