Microsoft Patches Two Actively Exploited Defender Zero-Days

Microsoft began deploying fixes Wednesday for a pair of Microsoft Defender vulnerabilities that threat actors have leveraged as zero-days.

The first, tracked as CVE-2026-41091 and known as RedSun, is a local privilege escalation flaw present in Microsoft Malware Protection Engine 1.1.26030.3008 and earlier versions. The engine supplies scanning, detection, and remediation functions for the company's antivirus and antispyware products. It arises from an improper link resolution before file access, a link-following weakness that reportedly lets attackers obtain SYSTEM-level access.

The second issue, tracked as CVE-2026-45498 and dubbed UnDefend, impacts the Microsoft Defender Antimalware Platform 4.18.26030.3011 and earlier. That platform is also utilized by System Center Endpoint Protection, System Center 2012 R2 Endpoint Protection, System Center 2012 Endpoint Protection, and Security Essentials. Microsoft stated that successful exploitation can produce denial-of-service conditions on vulnerable Windows systems.

The company addressed both problems with Malware Protection Engine version 1.1.26040.8 and Antimalware Platform version 4.18.26040.7. Officials noted that most customers require no manual intervention, because "the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Windows Defender Antimalware Platform are kept up to date automatically."

Security researchers recommend verifying that automatic updates for the Antimalware Platform and definition files remain enabled. Administrators can confirm installation by launching Windows Security, navigating to Virus & threat protection, selecting Protection updates, and clicking Check for updates. Under Settings > About, the Antimalware ClientVersion should match or exceed the patched release numbers.

On Thursday the U.S. Cybersecurity and Infrastructure Security Agency placed the two flaws in its Known Exploited Vulnerabilities catalog. CISA directed Federal Civilian Executive Branch agencies to secure affected Windows endpoints and servers by June 3 under Binding Operational Directive 22-01. The agency described such vulnerabilities as "a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise." It instructed organizations to apply vendor mitigations, adhere to related cloud guidance, or stop using the affected product when fixes are unavailable.

Microsoft also published guidance Tuesday for a separate Windows BitLocker zero-day known as YellowKey.