Microsoft Rushes Fixes for Two Actively Exploited Defender Zero-Days as CISA Adds Both to KEV
A disgruntled researcher's GitHub exploits may be behind attacks on the Malware Protection Engine and Antimalware Platform — but Microsoft isn't saying so.
Microsoft issued emergency patches on Wednesday for two zero-day vulnerabilities in Microsoft Defender components that are already being used in live attacks. CVE-2026-41091 allows local attackers to escalate privileges to SYSTEM level; CVE-2026-45498 can force the antimalware service offline. Both land on the same day CISA added them to its Known Exploited Vulnerabilities catalog.
The combination matters. Kill the detection engine, then own the machine. That is the attack sequence both flaws enable when chained, and it is exactly the kind of two-stage setup that makes endpoint-only defenses look flimsy.
CVE-2026-41091 sits inside mpengine.dll, the Microsoft Malware Protection Engine that handles file scanning across Microsoft Defender, Microsoft System Center Endpoint Protection, System Center 2012 R2 Endpoint Protection, System Center 2012 Endpoint Protection, and Microsoft Security Essentials. Microsoft classifies it as an improper link resolution before file access flaw — a shortcut- or symlink-following bug with a CVSS score of 7.8. CVE-2026-45498 lives in MsMpEng.exe, the Antimalware Platform process responsible for real-time monitoring alongside a set of kernel-mode drivers.
Security researchers have tied both flaws to proof-of-concept exploits called RedSun and UnDefend, published last month on GitHub by a person who goes by Nightmare Eclipse and describes themselves as a disgruntled former researcher. Microsoft's advisories for CVE-2026-41091 and CVE-2026-45498 do not mention RedSun, UnDefend, or Nightmare Eclipse by name. (I asked Microsoft's Security Response Center whether the exploits in the wild match those GitHub publications; the query sent Wednesday afternoon has not received a reply.)
And that omission is not minor. If the in-the-wild activity traces directly to those published proof-of-concepts, defenders need to know. Signatures targeting named exploits are written differently than generic heuristics.
The patch cadence makes this worse. Microsoft pushes malware definition updates three times daily, but platform binaries like mpengine.dll and MsMpEng.exe ship monthly or on an emergency basis. Many organisations assume Defender stays current automatically. It does not — not for the components that actually matter here.
Administrators should manually trigger an update check and confirm they are running Malware Protection Engine version 1.1.26040.8 or newer, and Microsoft Defender Antimalware Platform version 4.18.26040.7 or newer. The same MPE update also patches CVE-2026-45584, a remote code execution flaw Microsoft says has not been publicly disclosed or exploited. That last point deserves scrutiny: Microsoft said the same thing about CVE-2026-41091 before CISA's catalog entry proved otherwise.
Nightmare Eclipse has not been publicly identified. Who they are, who they may be working with, and why Microsoft's advisories refuse to acknowledge the exploit names already circulating — those questions remain open.
