ExploitPublished 23 Apr 2026

Recent Microsoft Defender Vulnerability Exploited as Zero-Day

Source SecurityWeek

Severity

Low

Rated by Threat Radar

Data as of 23 Apr 2026, 08:06 UTC

What to do

AI-suggested

Until an official fix is released, monitor for updates from Microsoft and apply any recommended security measures once available.

Description

A recently disclosed vulnerability in Microsoft Defender has been exploited as a zero-day. This flaw enables attackers to access the Security Account Manager (SAM) database, extract NTLM hashes, and escalate privileges to System level. The vulnerability is reported with low severity and no known exploits in the wild have been confirmed. No patch or remediation details are provided in the available information.

Impact

If exploited, attackers can gain elevated System privileges by extracting NTLM hashes from the SAM database, potentially leading to full system compromise. However, the severity is assessed as low and no active exploitation has been confirmed at this time.

Summary

The vulnerability in Microsoft Defender allows unauthorized access to the SAM database, which stores user credentials, enabling extraction of NTLM hashes. Successful exploitation grants attackers System-level privileges on the affected system. The report does not specify affected product versions or provide technical details beyond these capabilities.

References

securityweek.com/recent-microsoft-defender-vulnerability-exploited-as-zero-day/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 23 Apr 2026, 08:06 UTC

References

Community reviews