Microsoft Defender CVE-2026-41091 and CVE-2026-45498: exploited “RedSun” privilege escalation and “UnDefend” denial of service
Two exploited Defender bugs let a local user gain SYSTEM or disrupt Defender. Check for engine 1.1.26040.8 and platform 4.18.26040.7 or later on every machine.
- Published
- Updated
- Fixed in
- Microsoft Malware Protection Engine 1.1.26040.8 (CVE-2026-41091); Microsoft Defender Antimalware Platform 4.18.26040.7 (CVE-2026-45498)
- Exploitation
- Yes. Microsoft marked both “Exploitation Detected” on 19 May 2026; in CISA KEV since 20 May 2026; Huntress reported exploitation of the public RedSun and UnDefend exploits
Live scores
CVE-2026-41091- EPSS
- 0.082
some chance of attack soon - VEDAS
- 0.970
strong exploit evidence - On CISA KEV
- Yes, since 2026-05-20
- Detection rule
- Out of scope (local)
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-45498- EPSS
- 0.631
very likely to be attacked soon - VEDAS
- 0.659
some exploit evidence - On CISA KEV
- Yes, since 2026-05-20
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
What happened
On 19 May 2026, Microsoft published fixes for two Defender vulnerabilities that were already public and exploited (MSRC; MSRC):
- CVE-2026-41091 is a privilege escalation through improper link resolution (“link following”) in the Malware Protection Engine. A local, low-privileged attacker can gain SYSTEM. Rated CVSS 7.8. The last affected engine is 1.1.26030.3008; the first fixed is 1.1.26040.8.
- CVE-2026-45498 is a denial of service in the Defender Antimalware Platform. Rated CVSS 4.0. The last affected platform is 4.18.26030.3011; the first fixed is 4.18.26040.7.
Microsoft marked both as publicly disclosed and “Exploitation Detected”. CISA added both to its KEV catalog on 20 May 2026, with a federal deadline of 3 June (CISA KEV).
The bugs match two Defender zero-days, RedSun and UnDefend, published in April 2026 by a researcher known as Chaotic Eclipse or Nightmare-Eclipse. The researcher later confirmed that CVE-2026-41091 is RedSun and CVE-2026-45498 is UnDefend. Huntress observed exploitation of both, along with a third tool, BlueHammer (CVE-2026-33825) (The Hacker News). The same engine update also fixes CVE-2026-45584, a heap overflow rated CVSS 8.1 with no reported exploitation (The Hacker News).
Microsoft says systems where Defender is disabled are not in an exploitable state, even though vulnerability scanners may still flag the files on disk (MSRC).
Am I affected?
You are affected if Defender Antivirus is active and the engine is older than 1.1.26040.8 or the platform is older than 4.18.26040.7. Microsoft says the same engine and platform are used by System Center Endpoint Protection and Microsoft Security Essentials (MSRC).
On a single machine, in PowerShell:
Get-MpComputerStatus |
Select-Object AMEngineVersion, AMProductVersion, AntivirusEnabled, AntivirusSignatureLastUpdatedAMEngineVersion is the engine (needs 1.1.26040.8 or later) and AMProductVersion is the platform (needs 4.18.26040.7 or later). In the Windows Security app, the same numbers are under Settings > About (MSRC).
Across a fleet, report engine and platform versions from Defender for Endpoint, Intune or your management tool.
What to do now
- Confirm the engine and platform versions above on every Windows endpoint and server with Defender active. Microsoft says no manual action is needed when updates work normally (MSRC), so focus on finding the machines where they do not.
- Fix stalled update paths. Look at hosts that get Defender updates from WSUS, Configuration Manager or a file share, isolated networks, and VM templates or golden images that are restored with old engines. Force an update with
Update-MpSignatureor “Check for updates” in Windows Security, then recheck the versions. - Treat the public exploits as a local foothold-to-SYSTEM path. RedSun gives SYSTEM to any local user on an unpatched machine, so prioritise multi-user systems such as terminal servers, VDI hosts and shared lab machines.
- Investigate machines that were behind. If a host ran an engine older than 1.1.26040.8 after the April 2026 public release of RedSun and you see unexplained SYSTEM-level activity or Defender failing or stopping on it, investigate it as a potential compromise. The sources checked do not publish indicators of compromise.