CVE-2026-45498: Microsoft Defender Denial of Service Vulnerability

Overview

CVE-2026-45498 is an unspecified denial of service (DoS) vulnerability affecting Microsoft Defender. Its inclusion in CISA’s KEV catalog highlights its potential for active exploitation or significant risk. Successful exploitation could disrupt the availability of Microsoft Defender on affected systems, potentially leaving endpoints unprotected.

Technical Analysis

The vulnerability allows for a denial of service condition within Microsoft Defender. Specific details regarding the underlying mechanism are currently unspecified. According to the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), exploitation requires local access to the system, has low attack complexity, does not require any privileges or user interaction, and results in a low impact to availability. No specific affected versions have been publicly detailed beyond ‘Microsoft Defender’ generally.

Detection

Detecting this specific DoS event without detailed technical information is challenging. Defenders should monitor for general indicators of Microsoft Defender instability or failure:
* Unexpected termination or restart of Microsoft Defender processes (e.g., MsMpEng.exe).
* High CPU or memory utilization by Microsoft Defender services that precedes system instability or crashes.
* Windows Event Log entries indicating service crashes (e.g., Event ID 7031, 7034 from Service Control Manager) or application errors (e.g., Event ID 1000 from Application Error) related to MsMpEng.exe or other Defender components.
* Alerts from Endpoint Detection and Response (EDR) solutions indicating unusual behavior or resource consumption by security software.

Mitigations

1. Apply all available security updates from Microsoft as soon as they are released. This is the primary mitigation for known vulnerabilities.
2. Ensure Microsoft Defender is configured for automatic updates of both the engine and definition files to receive the latest protections.
3. Implement robust endpoint detection and response (EDR) solutions to monitor for and alert on unusual process behavior or resource consumption that could indicate a DoS attack or system instability.
4. Regularly review system logs for errors or warnings related to Microsoft Defender services.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-45498
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498
• https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.