Microsoft Defender Zero-Day CVE-2026-41091: Close This Gap Now

CVE-2026-41091 exploits a link-following weakness in mpengine.dll, the Microsoft Malware Protection Engine module that handles real-time scanning, file remediation, and malware cleaning. When Defender's threat remediation engine identifies a malicious file, it prepares to clean or quarantine it by resolving the file path. The vulnerability lies in the gap between path resolution and file access: an attacker inserts an NTFS junction point or symbolic link between those two operations using a batch opportunistic lock (oplock) technique.

The specific attack sequence proceeds as follows. First, the attacker drops a file that Defender scans and prepares to remediate. Second, the attacker pauses Defender's file operation by acquiring an oplock on the target file, creating a race condition window. Third, during that window, the attacker replaces the target file path with an NTFS junction redirecting to a privileged system path. Fourth, when the oplock releases, Defender follows the junction and writes under SYSTEM-level privileges to the redirected location, overwriting a protected system file chosen by the attacker.

This technique is a time-of-check to time-of-use (TOCTOU) race condition, a class of vulnerability also seen in the earlier BlueHammer (CVE-2026-33825) and RedSun exploits released by researcher Chaotic Eclipse in April 2026 as a public protest against Microsoft's vulnerability disclosure handling. Huntress Labs confirmed active exploitation of CVE-2026-41091 alongside CVE-2026-33825 in hands-on-keyboard intrusions, where attackers gained initial access through compromised SSL VPN credentials before deploying the Defender privilege escalation locally.

The vulnerability affects Microsoft Malware Protection Engine versions 1.1.26030.3008 and earlier across Microsoft Defender, Microsoft Security Essentials, Microsoft System Center Endpoint Protection, and all related products using mpengine.dll. Source: The Hacker News, BleepingComputer.

CVE-2026-45498 is a CVSS 4.0 denial-of-service vulnerability in the Microsoft Defender Antimalware Platform (versions 4.18.26030.3011 and earlier). On its own, CVE-2026-45498 carries a lower severity rating. Chained with CVE-2026-41091, it becomes the first stage of a two-step takedown of Windows endpoint security.

When an attacker triggers CVE-2026-45498, the Microsoft Defender Antimalware Platform enters a crash state and stops processing real-time protection events. Signature scanning halts. Behavior monitoring stops. Exploit protection rules no longer fire. The endpoint becomes functionally undefended for the duration of the crash, which attackers can re-trigger as needed.

This is the same class of capability as the UnDefend zero-day exploited in April 2026, which prevented Microsoft Defender from receiving definition updates so that freshly deployed malware had no available signatures to match. CVE-2026-45498 is a formally assigned CVE for a similar capability, now confirmed exploited in the wild.

The combined attack pattern observed by Huntress Labs proceeds as follows: the attacker establishes initial access via a compromised SSL VPN account, drops a small stager, triggers CVE-2026-45498 to crash Defender, then runs CVE-2026-41091 to escalate to SYSTEM without generating any Defender telemetry. From SYSTEM, the attacker can disable Windows Event Log, install persistence, and exfiltrate credentials before re-enabling Defender to avoid long-term detection gaps that would alert a security operations center.

Organizations running Microsoft System Center Endpoint Protection, Security Essentials, or third-party products that embed the Microsoft Defender Antimalware Platform SDK are also affected by CVE-2026-45498. Patch confirmation requires checking both the Malware Protection Engine version (must be 1.1.26040.8 or later) and the Antimalware Platform version (must be 4.18.26040.7 or later). Source: Help Net Security.

CISA confirmed active exploitation of both CVE-2026-41091 and CVE-2026-45498 when it added them to the KEV catalog on May 20, 2026. The agency set a compliance deadline of June 3, 2026 for all US Federal Civilian Executive Branch (FCEB) agencies under Binding Operational Directive 22-01, giving organizations 12 days to confirm remediation.

Microsoft assigned an "Exploitation Detected" status to both CVEs in its Security Response Center portal. Huntress Labs researchers reported observing "hands-on-keyboard threat actor activity" that included the Defender privilege escalation chain in multiple separate incident response cases during May 2026. All confirmed cases involved initial access via compromised SSL VPN credentials, consistent with the broader trend of identity-based initial access that accounted for 32.8 percent of all identifiable intrusion incidents in the first quarter of 2026, per a CrowdStrike threat intelligence report.

No specific threat actor group has been officially attributed to the CVE-2026-41091 and CVE-2026-45498 exploitation campaigns as of May 22, 2026. The connection to Chaotic Eclipse's publicly released proof-of-concept code from April 2026 suggests that multiple unrelated actors are operating independently using the same freely available exploit primitives.

Organizations face elevated risk in any environment with: shared Windows workstations or terminal servers where multiple low-privilege users have local access; Windows endpoints with disabled or delayed automatic update policies; air-gapped network segments that cannot reach Microsoft's signature distribution infrastructure; and environments where Defender's tamper protection was previously disabled by an attacker who already has low-level access.

The exploit primitives behind CVE-2026-41091 were developed and publicly released by a researcher operating under the aliases Chaotic Eclipse and Nightmare Eclipse in April 2026. The researcher published working proof-of-concept code for three Microsoft Defender vulnerabilities, BlueHammer (CVE-2026-33825), RedSun, and UnDefend, as a protest against what the researcher described as Microsoft's inadequate vulnerability disclosure handling and failure to credit independent security researchers.

That public release provided a ready-made exploitation toolkit for any threat actor willing to adapt it. Huntress Labs confirmed that multiple distinct intrusion sets began deploying the privilege escalation technique within 10 days of the PoC publication. CVE-2026-41091 and CVE-2026-45498 represent Microsoft's formal CVE assignments for two of those exploited capabilities: the SYSTEM privilege escalation (CVE-2026-41091 corresponds to the RedSun technique) and the antivirus-kill DoS (CVE-2026-45498 corresponds to the UnDefend technique).

From a threat actor perspective, this vulnerability class is highly attractive for both ransomware operators and espionage actors. Ransomware groups need to disable endpoint detection before deploying encryption payloads; CVE-2026-45498 provides that capability reliably. Nation-state actors conducting long-term dwell operations need to escalate from a compromised low-privilege account to SYSTEM for credential dumping and lateral movement; CVE-2026-41091 provides that capability without requiring kernel exploits.

The broader Windows Defender zero-day exploitation context connects directly to the pattern of Windows zero-day exploitation documented in April 2026, where APT28 weaponized a Windows Shell vulnerability with a similar TOCTOU race condition class for zero-click NTLM credential theft. Attackers are systematically working through Windows' security architecture layer by layer.

Patching CVE-2026-41091 and CVE-2026-45498 does not require a Windows OS update. Both fixes ship through Microsoft Defender's signature and platform update mechanism, which runs independently of Patch Tuesday. The remediation takes under five minutes on a connected endpoint but requires active verification because automatic updates are not guaranteed on isolated or misconfigured systems.

Run all five steps below before end of business today. For fleet-scale remediation using PowerShell, Intune, or SCCM, the detailed commands are available to subscribers below.

Microsoft Defender zero-day exploitation is categorically different from a typical application vulnerability because the security tool itself becomes the attack vector. Every organization running Windows relies on Defender as a baseline security control, either as the primary endpoint protection product or as a secondary layer beneath third-party AV software. When that baseline is compromised, the attacker has removed the safety net before their main attack begins.

The combination of CVE-2026-45498 and CVE-2026-41091 maps directly to an adversarial playbook documented in ransomware and APT intrusions throughout 2026: disable the defender, escalate privileges, operate freely. Both exploits derive from publicly released PoC code, which means the technical barrier to deployment is low. Any threat actor with a compromised domain account and local access can replicate this attack chain today using freely available tools.

The broader pattern of CISA Known Exploited Vulnerabilities additions in 2026 shows a consistent theme: attackers target security infrastructure first. Cisco SD-WAN authentication bypasses, Exchange Server spoofing flaws, and now Defender privilege escalation all represent attacks on the tools organizations trust to protect them. Closing this gap is not just about patching two CVEs. It is about restoring the integrity of your endpoint security baseline before attackers weaponize it further.

Five minutes of forced Defender updates today is worth days of incident response next week. Every Windows endpoint in your organization is a potential lateral movement target until it runs Malware Protection Engine 1.1.26040.8 and Antimalware Platform 4.18.26040.7. Source: CISA KEV Catalog, Malwarebytes.