VulnerabilityPublished 21 May 2026

Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days

Source SecurityWeek

Mentioned vulnerabilities

Severity

Medium

Rated Medium by Threat Radar from the SecurityWeek text

Data as of 21 May 2026, 15:52 UTC

What to do

AI-suggested

Microsoft has released official patches addressing both vulnerabilities in Microsoft Defender Antimalware Platform version 4.18.26040.7. Organizations should apply these updates promptly. Systems with Microsoft Defender disabled are not vulnerable. The US CISA recommends patching by June 3, 2026, especially for federal agencies. No additional mitigations are indicated beyond applying the official fixes.

Description

The bugs could be exploited to elevate privileges to System or create a denial-of-service (DoS) condition. The post Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days appeared first on SecurityWeek .

Impact

Successful exploitation of CVE-2026-41091 can lead to local privilege escalation to System level, potentially allowing attackers to gain full control of the affected system. CVE-2026-45498 can cause denial-of-service conditions, disrupting Defender operations. Both vulnerabilities have been exploited in the wild, indicating active threat. Systems without Defender enabled are not vulnerable. The impact is significant for affected systems but limited to local attackers for privilege escalation and DoS conditions.

Summary

Two zero-day vulnerabilities in Microsoft Defender were publicly disclosed and exploited in the wild. CVE-2026-41091 is a local privilege escalation vulnerability caused by improper link resolution before file access, allowing an authorized attacker to elevate privileges to System. CVE-2026-45498 is a denial-of-service vulnerability. Microsoft patched both in Defender Antimalware Platform version 4.18.26040.7. The vulnerabilities are variants of the BlueHammer exploit and have been added to CISA's KEV list, with a patch deadline for federal agencies of June 3, 2026. Systems with Defender disabled are not exploitable. The vendor advisory is minimal but confirms exploitation and patch availability.

References

securityweek.com/microsoft-patches-exploited-undefend-and-redsun-defender-zero-days/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 21 May 2026, 10:03 UTC

References

Community reviews

Related threats