Microsoft Defender Denial of Service Vulnerability

CVE-2026-45498 is a local denial-of-service flaw in the Microsoft Defender Antimalware Platform. The authoritative Microsoft CNA record and NVD change history point to affected platform builds through 4.18.26030.3011, with 4.18.26040.7 as the first fixed version; public reporting also notes that the platform is used not just by Defender but by System Center Endpoint Protection and older Security Essentials deployments. In plain English: a local attacker can disrupt Defender so it stops protecting the host as intended.

Microsoft's MEDIUM 4.0 baseline is too low for enterprise prioritization once you factor in reality: this is KEV-listed, Microsoft says it is exploited in the wild, and Huntress observed related UnDefend tooling in a real intrusion. The vendor score is still directionally correct about the *precondition*—the attacker needs local code execution first—but it understates the operational impact of temporarily blinding a security control that sits on a huge Windows fleet.

Why this verdict

• Upgrade for exploitation evidence: KEV listing and Microsoft/Huntress exploitation evidence are the main upward pressure; once attackers are using it, a vendor 4.0 label is not enough for fleet triage.
• Downgrade for attacker position: the Microsoft CNA vector is local. That implies the attacker already has code execution on the box, so this is post-initial-access and cannot by itself compromise a clean internet-facing host.
• Upgrade for blast-radius quality, not quantity: the impact is 'only' DoS, but the thing being denied is Defender itself. Temporarily blinding endpoint protection is materially worse than crashing some random userland app because it enables quieter follow-on abuse.

Why not higher?

This is not a remote pre-auth wormable bug, and the currently authoritative vendor vector does not support that story. Huntress also notes the disruption is not permanent—when the exploit process exits, the held handles are released and Defender recovers—so the worst-case impact usually depends on what the attacker does next, not on the DoS alone.

Why not lower?

A plain local low-availability DoS would normally stay in MEDIUM. What pushes it above that is the combination of real-world exploitation, public tooling, and the fact that the victim component is a security control whose temporary failure directly improves attacker operating conditions.

1. Force Defender platform currency — Validate that endpoints are on Defender Antimalware Platform 4.18.26040.7 or later and force update channels where drift exists. Because this is actively exploited, do this immediately, within hours, not on the normal monthly endpoint cadence.
2. Block untrusted local tooling — Use WDAC, AppLocker, or equivalent allow-listing to stop unsigned or low-reputation binaries from user-writable paths. This directly attacks the exploit chain's most important prerequisite—local execution—and should be tightened immediately, within hours on exposed admin/VPN populations.
3. Alert on Defender health degradation — Create detections for WinDefend stop/restart anomalies, abrupt Defender engine/platform health changes, and file-handle abuse against Defender definition paths. Stand this up immediately, within hours because it is the fastest way to catch both failed and successful attempts while patching catches up.
4. Hunt for staged public PoC artifacts — Search for binaries and command lines associated with UnDefend and nearby tooling in user-writable directories, especially after suspicious VPN or remote-access events. Run this hunt immediately, within hours because exploitation here is a strong indicator of broader host compromise.

Run this on the target Windows endpoint or via your remote management tool as local administrator. Invoke with powershell.exe -ExecutionPolicy Bypass -File .\Test-CVE-2026-45498.ps1; it checks the installed Defender Antimalware Platform version and returns VULNERABLE, PATCHED, or UNKNOWN.

# Test-CVE-2026-45498.ps1

# Checks Microsoft Defender Antimalware Platform version for CVE-2026-45498.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


[CmdletBinding()]
param()

$ErrorActionPreference = 'Stop'

function Convert-VersionToParts {
    param([string]$Version)
    if ([string]::IsNullOrWhiteSpace($Version)) { return $null }
    $clean = $Version.Trim()
    $segments = $clean.Split('.')
    $parts = @()
    foreach ($s in $segments) {
        $n = 0
        if (-not [int]::TryParse($s, [ref]$n)) { return $null }
        $parts += $n
    }
    return ,$parts
}

function Compare-VersionParts {
    param(
        [int[]]$A,
        [int[]]$B
    )
    $max = [Math]::Max($A.Count, $B.Count)
    for ($i = 0; $i -lt $max; $i++) {
        $av = if ($i -lt $A.Count) { $A[$i] } else { 0 }
        $bv = if ($i -lt $B.Count) { $B[$i] } else { 0 }
        if ($av -gt $bv) { return 1 }
        if ($av -lt $bv) { return -1 }
    }
    return 0
}

try {
    $fixedVersion = '4.18.26040.7'
    $vulnerableMax = '4.18.26030.3011'

    $mp = Get-MpComputerStatus -ErrorAction Stop
    $installedVersion = $mp.AMProductVersion

    if ([string]::IsNullOrWhiteSpace($installedVersion)) {
        Write-Output 'UNKNOWN - Defender AMProductVersion not available'
        exit 2
    }

    $installedParts = Convert-VersionToParts -Version $installedVersion
    $fixedParts = Convert-VersionToParts -Version $fixedVersion
    $vulnParts = Convert-VersionToParts -Version $vulnerableMax

    if ($null -eq $installedParts -or $null -eq $fixedParts -or $null -eq $vulnParts) {
        Write-Output ('UNKNOWN - Unable to parse version string: ' + $installedVersion)
        exit 2
    }

    $cmpFixed = Compare-VersionParts -A $installedParts -B $fixedParts
    $cmpVuln = Compare-VersionParts -A $installedParts -B $vulnParts

    if ($cmpFixed -ge 0) {
        Write-Output ('PATCHED - Defender Antimalware Platform version ' + $installedVersion + ' is >= ' + $fixedVersion)
        exit 0
    }

    if ($cmpVuln -le 0) {
        Write-Output ('VULNERABLE - Defender Antimalware Platform version ' + $installedVersion + ' is <= ' + $vulnerableMax)
        exit 1
    }

    Write-Output ('UNKNOWN - Defender Antimalware Platform version ' + $installedVersion + ' is between known vulnerable and fixed thresholds; verify against vendor advisory')
    exit 2
}
catch {
    Write-Output ('UNKNOWN - ' + $_.Exception.Message)
    exit 2
}

Sources

1. Microsoft Security Update Guide - CVE-2026-45498
2. NVD - CVE-2026-45498
3. CISA Known Exploited Vulnerabilities Catalog entry
4. Huntress - Nightmare-Eclipse Tooling Seen in Real-World Intrusion
5. Help Net Security - Microsoft Defender vulnerabilities exploited in the wild
6. BleepingComputer - Microsoft warns of new Defender zero-days exploited in attacks
7. FIRST EPSS
8. Nightmare-Eclipse GitHub profile