Microsoft Defender Remote Code Execution Vulnerability (CVE-2021-1647)

What is affected, what to do

Microsoft Defender Remote Code Execution Vulnerability

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft System Center Endpoint Protection eq 2012..2012

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Audit engine versions estate-wide: The flaw is in the Microsoft Malware Protection Engine (mpengine.dll), not the OS. Per Microsoft's advisory, engine version 1.1.17700.4 is the first fixed release (verify against the vendor advisory). Inventory via Intune, SCCM/MECM or remote PowerShell: Get-MpComputerStatus | Select AMEngineVersion, AMProductVersion, AntivirusSignatureLastUpdated. Treat anything older as vulnerable.
   • Force the engine update: Run "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate on stale hosts. Engine updates ship alongside security intelligence updates (KB2267602). In WSUS or MECM, confirm that the "Definition Updates" classification is auto-approved. Held approvals are the usual reason for lingering old engines.
   • Catch up offline and isolated networks: Update OT, lab and air-gapped systems manually with the offline package (mpam-fe.exe, available from Microsoft). In critical-infrastructure environments, these are typically where vulnerable engines remain.
   • Hunt legacy products: Query the asset inventory for Microsoft Security Essentials and System Center Endpoint Protection 2012. Verify their engine versions and schedule migration to the current Defender platform or Defender for Endpoint.
   • On suspected compromise: Network-isolate the host via EDR. A successful exploit runs inside MsMpEng.exe as SYSTEM, so treat local admin credentials, service accounts and cached domain credentials on that host as compromised and rotate them.
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration / update path: Set the security intelligence update source order via GPO (InternalDefinitionUpdateServer → MicrosoftUpdateServer → MMPC). This stops a WSUS outage from silently freezing engines on old versions.
   • Endpoint hardening: Enable Tamper Protection so the engine and real-time protection cannot be rolled back or disabled. Do not turn off real-time scanning as a workaround. It removes the trigger but opens a far larger gap.
   • Ingress filtering (mail/web): Exploitation is triggered when the engine scans a crafted file, and no user interaction is required. Detonate attachments and downloads in a mail gateway or proxy sandbox before they reach endpoints. Block or quarantine unusual containers (ISO, IMG, nested archives) and files whose magic bytes don't match their extension.
   • Network segmentation: Allow client egress only through an authenticating proxy. Blocking direct outbound connections from user VLANs breaks post-exploitation C2.
   • EDR rule (preventive): Block or high-priority alert on child processes of MsMpEng.exe other than known Defender binaries (MpCmdRun.exe, MpSigStub.exe, NisSrv.exe). Baseline in audit mode first.
3. 03

   Runbook step 3

   Detection rules

   • Sysmon EID 1 / Security 4688 – anomalous ancestry: ParentImage ends with \MsMpEng.exe and Image is a LOLBin or shell. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "MsMpEng.exe" and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe","mshta.exe")
   • Engine crashes as an exploitation signal: Application log Event ID 1000/1001 with faulting module mpengine.dll or faulting application MsMpEng.exe. Crashes shortly after a download or mail delivery suggest failed exploit attempts. SPL: index=wineventlog EventCode=1000 (Faulting_Module="*mpengine.dll*" OR Application="MsMpEng.exe")
   • Network activity from MsMpEng.exe: Sysmon EID 3 or DeviceNetworkEvents where InitiatingProcessFileName =~ "MsMpEng.exe" connects to destinations other than Microsoft cloud endpoints and the internal WSUS. Correlate with Zeek conn.log.
   • Defender Operational log: Watch for Event ID 5001 (real-time protection disabled), 5007 (configuration changed), 3002 (real-time protection failure) and 2001/2003 (update failure). Look for clusters or correlation with suspicious file arrivals.
   • File writes by MsMpEng.exe: Sysmon EID 11 where MsMpEng.exe writes executables or scripts (.exe, .dll, .ps1) outside ProgramData\Microsoft\Windows Defender\.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Microsoft Defender Remote Code Execution Vulnerability

Source: CSA/SingCERT, NVD (NIST), cvelistv5, CISA KEV Catalog

Vendors and products

• Microsoft Microsoft Security Essentials
• Microsoft Microsoft System Center Endpoint Protection
• Microsoft Microsoft Windows Defender

References & sources

• Microsoft Security Update GuideMicrosoft Defender Remote Code Execution VulnerabilityVendor advisory, Patch, Vendor advisory
• portal.msrc.microsoft.comen-US/security-guidance/advisory/CVE-2021-1647x_refsource_MISC, x_transferred, Patch, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1647government-resource, US government resource