New Microsoft Defender 0‑Days Actively Exploited in the Wild

Two newly disclosed, publicly exploited Microsoft Defender vulnerabilities (CVE-2026-41091 — local elevation of privilege via improper link/junction handling, and CVE-2026-45498 — Denial of Service in the Antimalware Platform) affect core Defender components across supported Windows versions. Microsoft and CISA confirm in-the-wild exploitation and have added the flaws to the KEV catalog; remediation is via automatic Defender engine/platform updates (fixed engine 1.1.26040.8 and platform 4.18.26040.7), and organizations are urged to verify update deployment and compliance under BOD 22-01.