CVE-2026-45498: Microsoft Defender Denial of Service Vulnerability
Microsoft Defender contains an unspecified vulnerability that allows for denial of service.
Overview
Microsoft Defender Antimalware Platform versions from 4.0.0.0 up to (but not including) 4.18.26040.7 contain an uncontrolled resource consumption flaw that can be triggered by a local, unprivileged attacker. Successful exploitation causes the Defender scanning engine to exhaust system resources, resulting in reduced performance or a service interruption. No credentials are required, but the attacker must have local access to the target system. Microsoft rates the maximum severity as Low.
Vulnerability details
The flaw is classified as CWE-400 (Uncontrolled Resource Consumption), a weakness in which an application fails to bound the resources it allocates when processing input. In the context of the Defender Antimalware Platform, the available sources do not specify the triggering input or which resource is exhausted. Components that process untrusted content are a plausible exposure point for this class of weakness, and a component that allocates resources without adequate limits can degrade or halt the service.
An attacker with local access to a vulnerable system, but without any account privileges, can present crafted input to the Defender scanning engine, most plausibly by writing a specially constructed file to a location the engine monitors. The engine processes the file and consumes resources in an uncontrolled manner, producing a denial-of-service condition rated as low availability impact. The advisory does not specify the exact resource exhausted or whether broader system stability is affected beyond the Defender service itself. No network access is required; the attack is confined to the local system.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor the Defender service process (MsMpEng.exe) for sustained, anomalous CPU or memory consumption that does not correspond to a scheduled scan or signature update, particularly when correlated with a local user session or newly written files.
- Review Windows Event Log entries under the Microsoft-Windows-Windows Defender/Operational channel for unexpected service restarts, engine errors, or scan-failure events that coincide with local interactive or scripted activity from non-administrative accounts.
Remediation
Additional hardening
- Upgrade the Microsoft Defender Antimalware Platform to version 4.18.26040.7 or later; on managed endpoints this update is typically delivered automatically through Windows Update or Microsoft Update, but verify deployment status across the fleet.
- Restrict local interactive and scripted access to sensitive endpoints, particularly servers and privileged workstations, to reduce the pool of accounts that could place crafted files in locations monitored by the scanning engine.
- Apply least-privilege principles to local user accounts so that unprivileged sessions capable of writing files are limited to designated, lower-risk systems where a Defender service disruption has minimal operational impact.
- Where Defender service availability is operationally critical, configure alerting on MsMpEng.exe process health and consider a secondary endpoint protection layer to maintain coverage if the primary engine is disrupted.
Key dates
References
Frequently asked questions
Does CVE-2026-45498 affect my FedRAMP authorization?
If Microsoft Defender runs inside your authorization boundary, yes. CVE-2026-45498 appears on CISA's Known Exploited Vulnerabilities (KEV) catalog, and its June 3, 2026 remediation deadline has already passed. For a FedRAMP-authorized service, an unpatched KEV is an assessor finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your path forward is either to remediate it or to formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-45498?
Knox does not patch your software. Remediating Microsoft Defender is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage that document the fix for your next assessment. Applying the patch is yours to do; maintaining a defensible compliance posture while you do it is not something you have to manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including CVE-2026-45498. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you a narrower window between disclosure and response.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-45498's remediation deadline of June 3, 2026 has passed. What happens now?
An unremediated CVE-2026-45498 is already a Plan of Action and Milestones (POA&M) item, and a growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing it out now and documenting why the deadline was missed is what keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
