Microsoft Addresses Three Vulnerabilities in Defender; CISA Adds Two to KEV
NEOSEC enrichment — no mirror of the original source
Microsoft has released fixes for two vulnerabilities in Microsoft Defender: a privilege elevation vulnerability due to improper link resolution before file access (CVE-2026-41091), and denial-of-service vulnerability (CVE-2026-45498). The U
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at SANS NewsBitesLinked advisories
- CVE-2026-45584Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.
- CVE-2026-45498Microsoft Defender Denial of Service Vulnerability
- CVE-2026-45584Microsoft Defender und Malware Protection Engine: Mehrere Schwachstellen
- CVE-2026-45584Microsoft Malware Protection Engine: Heap-basierter Pufferüberlauf
- CVE-2026-41091Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- CVE-2026-45584Microsoft Defender Remote Code Execution Vulnerability
- CVE-2026-45498Microsoft Defender Denial of Service Vulnerability
- CVE-2026-45498Microsoft Defender — Microsoft Defender Denial of Service Vulnerability
- CVE-2026-41091Microsoft Defender Elevation of Privilege Vulnerability
- CVE-2026-41091Microsoft Defender — Microsoft Defender Link Following Vulnerability
Affected vendors and products
More on Microsoft
Other advisories
- MediumCVE-2026-114148Microsoft .NET und ASP.NET: Schwachstelle ermöglicht Privilegieneskalation
- CriticalCVE-2026-106418Google Chrome / Microsoft Edge: Mehrere Schwachstellen
- CriticalCVE-2026-95367Google Chrome / Microsoft Edge: Mehrere Schwachstellen
- HighCVE-2026-62765Microsoft Edge (Chromium-based): Type-Confusion
- HighCVE-2026-62765Microsoft Edge (Chromium-based): Type-Confusion
- HighCVE-2026-85898Microsoft Edge (Chromium-based): Type-Confusion
- HighCVE-2026-85898Microsoft Edge (Chromium-based): Type-Confusion
- HighCVE-2026-83831Microsoft Edge (Chromium-based): Double-Free
Other news entries
- Microsoft urges Entra ID admins to migrate users to passkeysNewsBleepingComputer
- Microsoft .NET und ASP.NET: Schwachstelle ermöglicht PrivilegieneskalationVulnerabilityBSI CERT-Bund
- Multiples vulnérabilités dans Microsoft Edge (28 octobre 2026)NewsCERT-FR (ANSSI)
- Microsoft releases Windows OOB updates to distrust eMudhra certificatesNewsBleepingComputer
- The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses HardestNewsBleepingComputer
- Node2Shell puts Microsoft and Node.js on Brotli patch dutyNewsCSO Online
- Microsoft releases out-of-band Windows fixes with certificate updatesNewsThe Register — Security
- Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account TokensNewsThe Hacker News
Source: https://www.helpnetsecurity.com/
ID