Secuno
ENNL
Book demo

CVE-2026-45498

Microsoft Defender Denial of Service

4.0 MEDIUMActively exploited (CISA KEV)EPSS 1.27%
  1. Published20 May 2026
  2. Added to CISA KEV20 May 2026
  3. Remediation due3 Jun 2026
Actively exploited (CISA KEV)

Microsoft Defender contains an unspecified vulnerability that allows for denial of service.

Added to KEV: 20 May 2026Federal remediation due: 3 Jun 2026

Description

Microsoft Defender Denial of Service Vulnerability

CVSS 3.1 breakdown

Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityLow
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Microsoft Defender Antimalware Platform< 4.18.26040.7

Remediation

Fixed in
Microsoft Defender Antimalware Platform≥ 4.18.26040.7

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-904418.1
A missing authorization vulnerability in the wgagent management daemon's session…
CVE-2026-866088.2
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation…
CVE-2026-143218.2
The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client…
CVE-2026-336258.8
LMDeploy is a toolkit for compressing, deploying, and serving large language models.…
CVE-2026-834658.2
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business…
CVE-2026-834578.1
Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite…

Frequently asked

Is CVE-2026-45498 being actively exploited?

Yes. CVE-2026-45498 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 20 May 2026.

How severe is CVE-2026-45498?

CVE-2026-45498 has a CVSS 3.1 base score of 4.0, rated medium. EPSS estimates a 1.27% probability of exploitation.

Which products are affected by CVE-2026-45498?

Affected products include Microsoft Defender Antimalware Platform.

How do I fix CVE-2026-45498?

Upgrade affected software to a fixed version, for example Microsoft Defender Antimalware Platform 4.18.26040.7 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-45498 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.