The Security Tool Became the Primitive: Defender Reached SYSTEM and Lost Availability
Two Microsoft Defender vulnerabilities were exploited in the wild after public research showed how the security product itself could be used to gain SYSTEM privileges or disrupt protection. Microsoft fixed both issues through Defender’s normal update channels, and CISA added them to its Known Exploited Vulnerabilities catalog on 20 May 2026.
The more severe issue, CVE-2026-41091, is an improper link-resolution flaw in the Microsoft Malware Protection Engine. A local attacker with low privileges can abuse Defender’s file handling to elevate to SYSTEM, giving the attacker the highest practical level of control over the Windows host.
The second issue, CVE-2026-45498, is an uncontrolled resource-consumption problem in the Microsoft Defender Antimalware Platform. Microsoft rated it medium severity because the attack is local and its direct impact is denial of service. CISA nevertheless listed it as actively exploited because disabling or destabilizing the endpoint’s protection can be strategically valuable inside a larger intrusion.
RedSun reached SYSTEM. UnDefend attacked availability.
SecurityWeek linked the two CVEs to public techniques known as RedSun and UnDefend, part of a sequence of Defender research released by the security researcher known as Nightmare Eclipse or Chaotic Eclipse. The naming is useful context, but the operational facts come from Microsoft and CISA: both vulnerabilities were publicly disclosed, both were exploited, and both had fixes available.
CVE-2026-41091 exploits a privileged remediation path. Defender scans and moves files with service-level authority. If an unprivileged user can redirect a trusted file operation through a link, the security engine may act on a location chosen by the attacker. That crosses the boundary from a standard account into SYSTEM.
The result is more consequential than another local Windows escalation in isolation. Defender is present on a vast number of endpoints, and attackers commonly arrive with code execution under a user or service account. A reliable path from that foothold to SYSTEM can unlock credential theft, persistence, security-control tampering, and movement toward other systems.
CVE-2026-45498 attacks a different assumption. Endpoint protection must remain available while an incident is unfolding. A denial-of-service flaw that interrupts Defender can create the time and space for other tooling to run, even when it does not grant new privileges by itself.
Why a score of 4.0 still reached the KEV catalog
Microsoft assigned the denial-of-service issue a CVSS score of 4.0, while NIST’s independent enrichment produced 7.5 because it assessed a network attack path and high availability impact. The disagreement illustrates why defenders should not use a single score as a substitute for threat evidence.
CISA’s decision was based on exploitation, not on the larger number. It gave US federal civilian agencies until 3 June to remediate both flaws. For other organizations, the same prioritization logic applies: a security-control weakness under active use belongs ahead of routine high-severity backlog items that have no exploitation evidence.
Automatic updates need verification
Microsoft fixed CVE-2026-41091 in Malware Protection Engine version 1.1.26040.8. Earlier releases are affected. It fixed CVE-2026-45498 in Microsoft Defender Antimalware Platform version 4.18.26040.7. Microsoft Defender normally receives engine and platform updates automatically, so many systems will already be protected.
Automatic delivery is not the same as verified deployment. Administrators should inventory the installed engine and platform versions, investigate endpoints that are not updating, and confirm that security-intelligence distribution is healthy across servers, virtual desktops, disconnected networks, and machines controlled by restrictive update policies.
Incident responders should review exploitation windows that predate the corrected versions. Look for unusual file operations performed by Defender components, unexpected processes running as SYSTEM, tampering with Defender services or update paths, repeated protection-engine failures, and security gaps followed by unfamiliar executable activity.
Systems with Defender disabled were not exploitable through these specific paths, according to Microsoft reporting, even when Defender files remained on disk. That is not a mitigation strategy. The proper response is to run the fixed platform and verify that protection, telemetry, and updates are functioning.
The BlackTree lesson is that a trusted security component is still an attack surface. Its privileges make a flaw more valuable, and its automatic maintenance model makes version visibility essential.
Update, 1 September 2026: a third exploited Defender flaw was missing
The Defender exploitation picture also includes CVE-2026-33825, an access-control weakness in Microsoft Defender that can let an authorised local attacker elevate privileges. Microsoft fixed the affected Defender platform in version 4.18.26030.3011.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 22 April and records known ransomware use. It is distinct from the link-following privilege escalation in CVE-2026-41091 and the availability attack in CVE-2026-45498. Together, the three flaws show why Defender platform versions need the same verification as Windows cumulative updates.
Administrators should confirm the platform version across managed and intermittently connected endpoints, investigate hosts that missed automatic updates and review the exposure window for local privilege escalation, security-control changes and ransomware staging.
Primary sources: Microsoft Security Response Center and the CISA KEV catalogue.
Sources: Microsoft Security Response Center advisory for the privilege-escalation flaw, published 20 May 2026 at 09:16 UTC in the CVE record; Microsoft Security Response Center advisory for the denial-of-service flaw, published 20 May 2026 at 09:16 UTC in the CVE record; CISA Known Exploited Vulnerabilities Catalog, entries added 20 May 2026; SecurityWeek, published 21 May 2026 at 5:52 a.m. ET; Canadian Centre for Cyber Security, published 20 May 2026.
