Two zero-day vulnerabilities in Microsoft Defender were publicly disclosed and exploited in the wild. CVE-2026-41091 is a local privilege escalation vulnerability caused by improper link resolution before file access, allowing an authorized attacker to elevate privileges to System. CVE-2026-45498 is a denial-of-service vulnerability. Microsoft patched both in Defender Antimalware Platform version 4.18.26040.7. The vulnerabilities are variants of the BlueHammer exploit and have been added to CISA's KEV list, with a patch deadline for federal agencies of June 3, 2026. Systems with Defender disabled are not exploitable. The vendor advisory is minimal but confirms exploitation and patch availability.

Successful exploitation of CVE-2026-41091 can lead to local privilege escalation to System level, potentially allowing attackers to gain full control of the affected system. CVE-2026-45498 can cause denial-of-service conditions, disrupting Defender operations. Both vulnerabilities have been exploited in the wild, indicating active threat. Systems without Defender enabled are not vulnerable. The impact is significant for affected systems but limited to local attackers for privilege escalation and DoS conditions.

Microsoft has released official patches addressing both vulnerabilities in Microsoft Defender Antimalware Platform version 4.18.26040.7. Organizations should apply these updates promptly. Systems with Microsoft Defender disabled are not vulnerable. The US CISA recommends patching by June 3, 2026, especially for federal agencies. No additional mitigations are indicated beyond applying the official fixes.