CVE-2026-45498

What it actually does

This vulnerability allows a local, unauthenticated attacker to cause a denial of service condition in the Microsoft Defender antimalware platform. At a technical level, exploitation can disrupt Defender components such as the antimalware engine or service process, reducing or temporarily disabling endpoint protection capability. The flaw does not directly provide code execution, privilege escalation, or data access based on the provided CVSS vector, but it can impair availability of a critical security control.

Why it matters to the business

Successful exploitation can leave endpoints with degraded or unavailable malware protection, increasing the chance that other malware, hands-on-keyboard activity, or post-exploitation tools run without normal Defender inspection. Because this issue is listed in CISA KEV, has active in-the-wild exploitation, and has a remediation deadline of 2026-06-03, organizations should treat it as operationally urgent even though the CVSS severity is moderate. The main business risk is loss of endpoint protection coverage, increased incident response workload, and potential compliance or audit exposure where active antimalware is required.

How an attack unfolds

An attacker first obtains local access to a Windows system or otherwise causes content to be processed locally by Microsoft Defender. They then trigger the vulnerable Defender antimalware platform behavior, typically by presenting crafted local content, scan input, or activity that causes Defender to crash, hang, or stop providing normal protection. Once Defender is degraded, the attacker may use the protection gap to stage additional tools, execute malware, evade detection, or continue lateral movement with reduced endpoint visibility. Exploitation is reported as active in the wild; the provided threat-actor field does not identify a distinct named actor beyond the vulnerability itself.

How to fix it

Update the Microsoft Defender antimalware platform to the latest available release through Microsoft Update, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or the organization’s endpoint management tooling. Because no exact fixed version was provided, verify directly against Microsoft’s official advisory and Defender platform release notes, then ensure all affected systems receive the corrected antimalware platform, not only the latest security intelligence definitions. Where immediate patching is not possible, reduce local attack opportunities by limiting untrusted local execution, tightening application control, monitoring Defender health, and ensuring another EDR or security control can alert if Defender becomes disabled or unhealthy. Prioritize remediation before the KEV due date of 2026-06-03.

How to confirm the fix worked

Confirm that endpoints are running a Microsoft Defender antimalware platform version documented by Microsoft as fixed for this vulnerability. Use Microsoft Defender for Endpoint, Intune, PowerShell, or endpoint management inventory to collect Defender platform versions and health state at scale. Validate that real-time protection is enabled, the WinDefend service is running, Defender components are not repeatedly crashing, and the platform successfully updates. On representative systems, confirm that Defender Operational event logs show normal startup and update behavior after remediation, with no recurring engine failure, service termination, or scan failure events.

Typical attack path

1. Gain local execution capability or the ability to place content on a target endpoint.
2. Introduce crafted content or activity that is inspected by Microsoft Defender.
3. Trigger the vulnerable Defender antimalware platform condition.
4. Cause Defender service, engine, or scanning functionality to stop, crash, or become unreliable.
5. Use the reduced protection window to run additional tools, malware, or post-exploitation activity.
6. Attempt to maintain access or repeat the trigger to keep endpoint protection degraded.

How to detect it

To determine whether this was already exploited, review Defender health and Windows event telemetry for unexpected Defender crashes, service stops, scan failures, or repeated restarts, especially followed by suspicious process creation or malware activity. Relevant sources include Microsoft-Windows-Windows Defender/Operational, Windows System logs for Service Control Manager events, Windows Application logs for application crashes and Windows Error Reporting, Microsoft Defender for Endpoint device timeline, EDR process telemetry, and Defender support logs under ProgramData. Focus on sequences where MsMpEng.exe, WinDefend, or Defender engine components fail unexpectedly without an authorized maintenance action. Correlate these events with new files written to user-writable directories, execution from temporary paths, LOLBin use, persistence creation, disabled security settings, or network connections to suspicious infrastructure. Because no exploit-specific payload string is available from the provided data, detection should emphasize Defender availability degradation plus follow-on attacker behavior.

• Microsoft-Windows-Windows Defender/Operational
• Event ID 5008
• Event ID 5013
• Event ID 5007
• Service Control Manager 7031
• Service Control Manager 7036
• WinDefend
• MsMpEng.exe
• Faulting application name: MsMpEng.exe
• Windows Error Reporting
• C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-*.log
• C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service

What your security team should do

• Treat this as a KEV-driven priority and remediate affected Microsoft Defender antimalware platform installations before 2026-06-03.
• Inventory Defender platform versions across Windows endpoints and identify systems that are stale, unmanaged, offline, or failing updates.
• Deploy the latest Defender antimalware platform update using centralized endpoint management and verify successful installation.
• Create alerts for Defender service stoppage, repeated MsMpEng.exe crashes, Defender engine failures, disabled real-time protection, and update failures.
• Review recent endpoint telemetry for signs Defender became unavailable shortly before suspicious process execution, malware detections, persistence changes, or lateral movement.
• Harden endpoints by limiting untrusted local execution with application control, least privilege, and script restriction policies.
• Ensure compensating EDR visibility is active on systems where Defender health is degraded or remediation is delayed.