2 New Microsoft Defender Zero-Days Exploited—Patch Now Rolling Out

Microsoft confirmed two Microsoft Defender zero-days, CVE-2026-41091 and CVE-2026-45498, are being actively exploited in the wild.

The bugs affect components including the Malware Protection Engine, Antimalware Platform, and System Center Endpoint Protection.

One flaw could allow SYSTEM-level privilege escalation, while the other can trigger denial of service on protected systems.

CISA added both CVEs to its Known Exploited Vulnerabilities catalog and ordered federal mitigation by June 3.

Microsoft has started an emergency automatic update rollout, and organizations should verify the fix is installed immediately.