Microsoft Defender Zero-Days Exploited in Wild: Your Antivirus Is the Attack Vector

The software that’s supposed to protect your Windows PC from hackers just became the way hackers get in. Two Microsoft Defender zero-day vulnerabilities — CVE-2026-41091 (codenamed “RedSun”) and CVE-2026-45498 (codenamed “UnDefend”) — are being actively exploited in the wild right now. One gives attackers SYSTEM-level access to your machine. The other silently disables your antivirus definition updates, leaving you exposed without knowing it.

Let that sink in. The tool that 1.4 billion Windows users rely on as their primary line of defense against malware is, at this moment, the attack surface being used against them. CISA has added both CVEs to its Known Exploited Vulnerabilities catalog and set a June 3, 2026 deadline for federal agencies to patch. If you’re reading this, you need to verify your Defender version immediately — we’ll show you exactly how below.

Microsoft Defender Zero-Day: Your Antivirus Is the Backdoor

There’s a cruel irony in security software being the vulnerability. Antivirus programs run with the highest privileges on your system — they need to, because they must inspect every file, every process, every network connection. But that same elevated access means that when an antivirus product has a flaw, attackers don’t just get normal user access. They get the keys to the entire kingdom.

This Microsoft Defender zero-day situation is particularly nasty because it’s a two-punch combo. CVE-2026-41091 (RedSun) provides local privilege escalation to SYSTEM — the highest privilege level on a Windows machine. CVE-2026-45498 (UnDefend) then prevents Defender from updating its malware definitions, which means even after the initial compromise, the victim’s machine won’t detect new threats deployed by the attackers.

Used together, these vulnerabilities create a devastating attack chain: gain SYSTEM access, then blind the security software so it can’t see what you’re doing next. It’s the digital equivalent of breaking into a house and then disabling the alarm system and security cameras.

This isn’t the first time we’ve seen security infrastructure become the target. The cPanel zero-day that compromised 44,000 servers earlier this year followed the exact same pattern — attacking the management tool rather than the assets it manages. Attackers have learned that the most powerful tools are the most valuable targets.

CVE-2026-41091 RedSun: From User to SYSTEM in One Exploit

CVE-2026-41091, codenamed “RedSun” by threat researchers, is the more severe of the two vulnerabilities with a CVSS score of 7.8 (High). It’s a local privilege escalation (LPE) vulnerability in the Microsoft Malware Protection Engine — the core scanning component that powers both Microsoft Defender Antivirus and Microsoft Defender for Endpoint.

The vulnerability allows a local attacker (or malware running under a standard user account) to escalate privileges to SYSTEM. In practical terms, if an attacker has already gained initial access to a machine — say, through a phishing email that drops a payload running as a regular user — they can exploit RedSun to elevate to SYSTEM privileges without triggering any additional alerts. From there, it’s game over: they can install rootkits, dump credentials, move laterally through a network, and exfiltrate data.

The attack vector is local, which means the attacker needs some form of initial access first. But in enterprise environments, phishing provides that initial foothold constantly. An employee clicks a link, downloads a document, and a lightweight payload runs under their user account. Normally, the damage would be limited to that user’s files and access. With RedSun, that limited access becomes unlimited.

Security researchers who analyzed the exploit say it targets a flaw in how the Malware Protection Engine handles specific file operations during real-time scanning. When Defender scans certain crafted files, the engine incorrectly follows a symlink (symbolic link), allowing the attacker’s code to execute in the engine’s SYSTEM context. The technique is elegant in its simplicity — the attacker doesn’t need a kernel exploit or a complex chain. They just need Defender to scan a specially crafted file, which it does automatically.

CVE-2026-45498 UnDefend: Killing Your Antivirus Updates

CVE-2026-45498, nicknamed “UnDefend,” is rated lower at CVSS 4.0 (Medium) — but don’t let the score fool you. While it’s classified as a Denial of Service vulnerability, its real-world impact when combined with RedSun is far worse than the score suggests.

UnDefend targets Microsoft Defender’s definition update mechanism. By exploiting this flaw, an attacker can prevent Defender from downloading and applying new malware definitions. The antivirus continues to run and appears healthy in the Windows Security dashboard — the icon stays green, the status shows “Protection is up to date” — but it’s lying. No new definitions are being loaded, which means any new malware deployed after the exploit won’t be detected.

This is a stealth vulnerability. The user sees no errors. The system tray icon doesn’t change. Windows Security Center reports everything is fine. The only way to notice is to manually check the “last updated” timestamp on your malware definitions, which approximately zero normal users ever do.

In an attack scenario, the threat actor first uses RedSun (CVE-2026-41091) to gain SYSTEM access, then deploys UnDefend (CVE-2026-45498) to blind the security software. From that point, they have unrestricted access to a machine whose antivirus cannot detect anything new. They can install custom malware, exfiltrate data over weeks, and maintain persistent access without triggering a single Defender alert. It’s a textbook advanced persistent threat (APT) technique now available to anyone with access to the exploit code.

Microsoft Defender Zero-Day Exploited in the Wild

Both vulnerabilities carry the dreaded “Exploited in the Wild” label, confirmed by Microsoft and independently verified by multiple threat intelligence firms. This means these aren’t theoretical vulnerabilities found by researchers in a lab — real attackers are actively using them against real targets right now.

The initial exploitation appears to target enterprise environments, which makes sense given the attack chain’s sophistication. The threat actors are using spear-phishing emails to gain initial access, then deploying the RedSun exploit for privilege escalation, followed by UnDefend to maintain stealth. Multiple incident response firms have reported seeing this exact chain in active investigations.

What’s particularly concerning is the timeline. Microsoft hasn’t disclosed when they became aware of active exploitation, but CISA’s rapid addition to the KEV catalog and the aggressive June 3 deadline suggest the agency believes exploitation is widespread enough to constitute an emergency. As we’ve documented with the rise of AI-assisted attacks in 2026, threat actors are getting faster at weaponizing vulnerabilities once they’re discovered.

Individual consumers are at risk too. While the initial campaigns target enterprises, exploit code for both vulnerabilities is reportedly circulating in underground forums. It’s only a matter of time — likely days, not weeks — before commodity malware incorporates these exploits for mass distribution through drive-by downloads and malvertising campaigns.

CISA KEV Catalog and the June 3 Federal Deadline

The Cybersecurity and Infrastructure Security Agency (CISA) added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog — a list that carries binding operational directives for federal agencies. Under BOD 22-01, all Federal Civilian Executive Branch (FCEB) agencies must patch KEV-listed vulnerabilities by the specified deadline. For these two Defender flaws, that deadline is June 3, 2026.

A June 3 deadline means CISA views these as critical enough to require remediation within days, not weeks. For context, KEV deadlines typically range from two weeks to 30 days. Getting a deadline this tight indicates CISA has intelligence suggesting active exploitation at scale or targeting of critical infrastructure.

While the KEV catalog is technically only binding for federal agencies, CISA strongly recommends that all organizations — private sector, state and local governments, and individuals — treat KEV entries as emergency patches. If the federal government considers these vulnerabilities dangerous enough to mandate rapid patching across all agencies, you should probably take the hint.

How to Check If Your Microsoft Defender Is Patched

Microsoft has released patches for both vulnerabilities. The fixed versions are:

• Malware Protection Engine: Version 1.1.26040.8 or later
• Antivirus Platform: Version 4.18.26040.7 or later

To check your current version on Windows 10 or 11:

1. Open Windows Security (search for it in the Start menu)
2. Click Settings (gear icon at the bottom left)
3. Scroll down to About
4. Check Engine version and Platform version

If your engine version is below 1.1.26040.8 or your platform version is below 4.18.26040.7, you are vulnerable. To force an update: open Windows Security > Virus & threat protection > Protection updates > Check for updates. If the update fails, that could itself be a sign of compromise — the UnDefend vulnerability blocks definition updates.

Enterprise administrators should push updates through Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager, or Intune. Verify deployment across all endpoints — don’t assume auto-update is working, because the entire point of CVE-2026-45498 is to break the update mechanism.

Why Antivirus Software Is a Prime Attack Target

This Microsoft Defender zero-day incident isn’t an anomaly. Security software has become one of the most targeted attack surfaces in modern cybersecurity, and there’s a simple reason: these products run with the highest privileges and process untrusted input by design.

Think about what an antivirus engine does. It opens, parses, and analyzes every file on your system — executables, documents, archives, scripts, memory dumps. It does this with SYSTEM privileges because it needs access to everything. And it does this on untrusted, potentially malicious input because that’s literally its job. From an attacker’s perspective, the antivirus engine is a SYSTEM-privileged file parser that you can force to process arbitrary input. That’s a dream target.

We’ve seen this pattern repeatedly: cPanel being used to compromise the servers it manages, VPN appliances being exploited to breach the networks they protect, and now Defender being weaponized against the systems it defends. The security tool is the attack vector. This is the fundamental paradox of security software in 2026.

Google Project Zero, Trend Micro’s ZDI, and independent researchers have collectively reported dozens of critical antivirus vulnerabilities over the past few years affecting every major vendor — Kaspersky, Norton, McAfee, ESET, and now Microsoft. The takeaway isn’t that any one vendor is worse than others. It’s that the entire paradigm of a single privileged process scanning all system activity creates an inherently dangerous concentration of trust.

Microsoft Defender Zero-Day: What You Should Do Right Now

Don’t wait. Patch immediately. Here’s your action plan:

1. Check your Defender version (instructions above). Update immediately if below 1.1.26040.8 / 4.18.26040.7.
2. Verify definition timestamps. Open Windows Security > Virus & threat protection and confirm your “Security intelligence” was last updated within the past 24 hours. If it’s stuck on an old date, your update mechanism may already be compromised.
3. Run a full scan. After updating, run a full system scan (not Quick Scan). If RedSun was used to deploy additional malware, you need Defender’s updated definitions to find it.
4. Enable tamper protection. Windows Security > Virus & threat protection > Virus & threat protection settings > Tamper Protection ON. This adds an extra layer of protection against unauthorized changes to Defender.
5. Monitor for anomalies. Check for unexpected new user accounts, services, or scheduled tasks. These are common persistence mechanisms after a SYSTEM-level compromise.

For enterprise security teams: don’t just patch — hunt. If your environment was running vulnerable Defender versions during the exploitation window, assume compromise and conduct a threat hunt. Look for suspicious symlink creation, unusual Defender service restarts, and signs of credential dumping. The SYSTEM access from RedSun means attackers could have touched anything.

The Microsoft Defender zero-day saga is a reminder that no security product is a silver bullet. Defense in depth — multiple layers of security controls, network segmentation, least privilege access, and continuous monitoring — remains the only approach that works when any single layer can be compromised. Your antivirus just proved that point in the most uncomfortable way possible.