Updated July 31, 2026: This article has been refreshed to reflect that Microsoft’s emergency Defender fixes have now been available for more than two months and that CISA’s federal remediation deadline has passed. The key operational focus has shifted from immediate patch availability to verification, hunting, and cleanup on systems that may have lagged behind.
What We Know: Microsoft rushed Defender fixes outside Patch Tuesday
Microsoft pushed emergency Defender fixes on May 21 after two zero-days, RedSun and UnDefend, were already being used in live attacks.
The out-of-band updates landed after Huntress confirmed real-world exploitation and after researcher Chaotic Eclipse publicly disclosed the flaws without coordinated disclosure, according to Notebookcheck. At first public disclosure, the bugs had no CVEs and no available fixes.
That sequence matters. These were not theoretical proof-of-concept bugs waiting for a future patch cycle. Attackers had working paths before Microsoft’s emergency update was available.
The more serious vulnerability is tracked as CVE-2026-41091. It carries a CVSS score of 7.8 and affects the Microsoft Malware Protection Engine. The flaw stems from improper link resolution before file access, allowing a low-privileged attacker to manipulate a symbolic link or directory junction during a Defender scan and escalate to SYSTEM-level control.
No elevated starting permissions are required for that flaw, according to the source material. That raises the operational risk because an attacker who already has limited access could potentially turn Defender’s own scan behavior into a privilege-escalation path.
The second bug, CVE-2026-45498, is rated CVSS 4.0 and targets the Microsoft Defender Antimalware Platform. It works as a denial-of-service against the protection engine, silently blocking definition updates and reducing Defender’s ability to catch newer threats.
That second issue affects System Center Endpoint Protection, System Center 2012 R2 and 2012 Endpoint Protection, Security Essentials, and standard Defender installations. Neither vulnerability triggers a visible alert to the user or administrator during exploitation, based on the available reporting.
Microsoft fixed both CVEs in Malware Protection Engine version 1.1.26040.8 and Antimalware Platform version 4.18.26040.7. The company delivers the fixes through Defender’s built-in update mechanism, but administrators still need to verify deployment, especially where updates are delayed by policy, isolation, offline imaging, maintenance windows, or managed rollout controls.
At this point, any endpoint still running older engine or platform builds should be treated as a missed emergency remediation item, not a normal patch backlog issue.
Why It Matters: Defender itself became part of the attack surface
Security teams treat Microsoft Defender as a control plane inside Windows environments. These flaws cut directly into that assumption.
CVE-2026-41091 is the sharper concern because it can move a low-privileged attacker to SYSTEM-level control through file-system manipulation during a Defender scan. In practical terms, that turns a defensive workflow into a privilege-escalation opportunity.
CVE-2026-45498 hits a different part of the problem. Rather than grabbing higher privileges, it degrades protection by blocking definition updates. That creates a quieter risk: a machine may appear to have protection installed while its ability to detect newer threats weakens.
Huntress’ confirmation of active exploitation moved this from patch-management backlog to incident-response queue. Managed service providers, enterprise security teams, and Windows administrators should assume some exposed systems may have been targeted before fixes were available.
There was also a timing problem. Microsoft’s normal Patch Tuesday cadence did not contain these updates. Out-of-band patches are reserved for issues that cannot comfortably wait, and here the reason was clear: public disclosure, no initial fixes, and confirmed exploitation.
The disclosure chain added more pressure. RedSun and UnDefend were the fourth and fifth zero-days released by Chaotic Eclipse over a six-week span, all targeting Windows security components. MiniPlasma, another disclosure in that series, was reported at the time as unpatched and capable of giving SYSTEM access on fully patched Windows 11 machines through the Cloud Filter driver.
Microsoft’s update for CVE-2026-41091 also addressed CVE-2026-45584, a heap-based buffer overflow with a CVSS score of 8.1 that allows remote code execution without user interaction. That third flaw had not been confirmed exploited in the wild in the reporting cited here.
Analysis: the clustering matters less because of the researcher drama and more because the targets are defensive components. When attackers aim at endpoint protection, patch status alone does not answer the full question. Security teams also need to know whether the control was bypassed, degraded, or abused before the update landed.
That is especially important for organizations that rely on Defender telemetry for detection and response. A compromised or degraded endpoint security component can create blind spots in the same systems defenders use to investigate incidents.
What Is Still Unclear: The attack details remain thin
What exactly did attackers do with RedSun and UnDefend? The available reporting confirms exploitation, but it does not provide a full victim profile, attacker attribution, infrastructure details, or a complete set of indicators of compromise.
Did every exposed Defender deployment face the same risk? Not necessarily. The source material identifies affected components and products, but administrators should rely on Microsoft’s advisory and their own tooling for precise version checks, configuration exposure, and remediation status.
Were attacks broad or targeted? The supplied material does not establish scale. Huntress confirmed real-world use, but the available details do not support firm claims about campaign size, sectors hit, geography, or financial impact.
Can organizations assume automatic updates solved the problem? They should not. Microsoft delivers the fixes automatically through Defender’s built-in update path, but air-gapped systems, managed environments, gold images, VDI pools, delayed update rings, and legacy endpoint protection deployments can lag behind.
CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on May 20, 2026. Federal Civilian Executive Branch agencies had until June 3 to confirm patching. That deadline has now passed, making the CISA entry a useful benchmark for private-sector teams reviewing whether remediation occurred on time.
Analysis: the lack of visible alerts during exploitation is one of the most uncomfortable details. If abuse does not notify users or administrators, defenders cannot rely on obvious symptoms. They need version verification, telemetry review, and endpoint investigation where risk is highest.
The open question now is not only “are we patched?” It is also “were any systems exposed long enough to justify compromise assessment?” For high-value endpoints, domain administration workstations, servers with sensitive data, and managed service provider tooling hosts, that second question matters.
What To Watch: Treat patching as the start of response
Administrators should first confirm that Malware Protection Engine version 1.1.26040.8 and Antimalware Platform version 4.18.26040.7, or newer, are deployed across Windows fleets. That check should include managed endpoints, servers, legacy Microsoft endpoint protection products, VDI images, offline systems, and devices that do not receive standard automatic updates.
Security teams can verify Defender state through central management tooling or locally with Defender status checks that report engine, platform, and signature versions. The important point is to confirm the deployed versions, not merely assume that automatic updates completed successfully.
Teams should also review endpoint alerts and telemetry around Defender service behavior. The source material specifically points to silent update blocking and abuse during Defender scanning, so unusual protection-engine behavior, failed definition updates, tampering signals, repeated update failures, unexpected exclusions, or unexplained service degradation deserve quick escalation.
Where older versions are found, organizations should remediate immediately and consider a targeted lookback. That review should focus on the period before the May 21 emergency update and any later period in which the system remained unpatched.
The next useful disclosures would be indicators from Microsoft, Huntress, or other responders. Watch for any published IOCs, affected-version clarifications, exploitation timelines, or guidance on hunting for prior compromise.
Another watch item is MiniPlasma. The supplied reporting said it remained unpatched and belonged to the same recent series of Chaotic Eclipse disclosures targeting Windows security components. If more details emerge or Microsoft ships a fix, administrators should fold that into the same exposure review.
The core takeaway is narrow but urgent: Microsoft patched RedSun and UnDefend, but these zero-days were exploited before fixes existed. For organizations running Defender at scale, installing the update closes the known holes. It does not answer whether attackers already used them.
Impact Analysis
- Attackers were exploiting both flaws before Microsoft released emergency fixes.
- The higher-severity bug could let a low-privileged attacker gain SYSTEM-level control.
- The update-blocking flaw could quietly reduce Defender’s ability to detect newer threats.
- CISA’s federal remediation deadline has passed, so unpatched systems now represent overdue emergency exposure.
- Security teams should verify Defender engine and platform versions and review telemetry for signs of prior abuse.
