CISA added Microsoft Defender CVE-2026-45498 to KEV on 2026-05-20. MSRC marks exploitation detected and gives the exact fixed Defender Antimalware Platform version 4.18.26040.7.
Defender Action Panel
Check whether your environment installed affected software, copy the top IOCs, run the tested hunting script when available, then review remediation guidance.
CISA added CVE-2026-45498 to KEV on 2026-05-20 with a due date of 2026-06-03 CISA KEV opens in a new tab. MSRC marks exploitation detected and identifies 4.18.26040.7 as the first fixed Microsoft Defender Antimalware Platform version, with 4.18.26030.3011 as the last affected platform version reference MSRC opens in a new tab.
Cve: CVE-2026-45498
Vendor: Microsoft
Product: Microsoft Defender Antimalware Platform
Kev Added: 2026-05-20
Kev Due: 2026-06-03
Vulnerability: Denial of service
Cwe:
Affected Versions:
Fixed Versions:
Cvss V31: 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Msrc Exploited: true
Msrc Publicly Disclosed: true
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L NVD opens in a new tab.| Classification | Criteria | Required evidence | Remediation trigger | Closure condition |
|---|---|---|---|---|
| Confirmed compromise | Defender service crash, protection interruption, or platform failure appears on a host with affected platform version. | Platform version, host, timestamped Defender/System event, and service state. | Preserve Defender Operational and System events around the interruption. | Platform is at least 4.18.26040.7 and service-crash audit has no unexplained failures. |
| Presumed exposed | Defender platform is >= 4.18.26030.3011 and < 4.18.26040.7. | Get-MpComputerStatus output or EDR inventory. | Keep the host in scope until fixed platform verification succeeds. | Version verifier returns in_affected_range: false. |
| Potentially exposed | Defender exists but platform version is missing. | Host inventory or scanner row naming Defender or CVE-2026-45498. | Collect Defender platform version. | Host resolves to confirmed compromise, presumed exposed, not exposed, or unknown. |
| Not exposed | Defender platform is absent, disabled in a non-exploitable state per MSRC context, or version is at least 4.18.26040.7. | Version output and Defender state. | None for this CVE. | Evidence is attached to the host record. |
| Unknown | Host cannot provide Defender version or event exports. | Gap statement naming missing hosts or telemetry. | Keep high-value Windows hosts in scope. | Evidence is recovered or the risk owner accepts the named gap. |
This is a local Defender Antimalware Platform denial-of-service issue. The closure anchor is exact platform version 4.18.26040.7 or newer.
MSRC classifies the issue as denial of service with local attack vector and no required privileges MSRC opens in a new tab. The useful detection path is platform version plus Defender service interruption telemetry. [1]
Asset Selectors:
Version Selectors:
Windows Event Ids:
The following indicators of compromise (IOCs) can be used to scope exposure across local repositories, systems, and telemetry exports:
The following PowerShell script can be executed to apply mitigations or verify the patch status:
$ErrorActionPreference = "Stop"
$Out = $env:OUT
if ([string]::IsNullOrWhiteSpace($Out)) { $Out = "hp-defender-cve-2026-45498-closure" }
New-Item -ItemType Directory -Force -Path $Out | Out-Null
$Cve = "CVE-2026-45498"
$FixedPlatform = [version]"4.18.26040.7"
$AffectedStart = [version]"4.18.26030.3011"
$Status = Get-MpComputerStatus
$Platform = [version]$Status.AMProductVersion
$Closed = ($Platform -ge $FixedPlatform)
[pscustomobject]@{
cve = $Cve
computer = $env:COMPUTERNAME
platform_version = $Status.AMProductVersion
affected_start = "4.18.26030.3011"
fixed_platform = "4.18.26040.7"
closure_state = $Closed
msrc_source = "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498"
remediation_trigger = "Platform version below 4.18.26040.7 on a host at or above 4.18.26030.3011 keeps CVE-2026-45498 open."
} | ConvertTo-Json | Out-File -Encoding utf8 -FilePath (Join-Path $Out "defender-cve-2026-45498-closure.json")
# Remediation trigger: platform version below 4.18.26040.7 on a host at or above 4.18.26030.3011 keeps CVE-2026-45498 open.
Write-Host "wrote $Out"
Compromised workstations expose active API credentials, requiring immediate rotated revocation. The following platforms are at risk:
| Date | Event | Description | Source |
|---|---|---|---|
| May 26, 2026 | Discovery | Discovery recorded for Microsoft Defender CVE-2026-45498: KEV Platform DoS Exposure. | msrc.microsoft.com |
| May 26, 2026 | First seen | First seen recorded for Microsoft Defender CVE-2026-45498: KEV Platform DoS Exposure. | msrc.microsoft.com |
| May 26, 2026 | Disclosure | Disclosure recorded for Microsoft Defender CVE-2026-45498: KEV Platform DoS Exposure. | msrc.microsoft.com |
| May 26, 2026 | Microsoft Defender CVE-2026-45498: KEV Platform DoS Exposure | Unknown | msrc.microsoft.com |
| Package | Ecosystem | Version Range | Status | Confidence | Source |
|---|---|---|---|---|---|
| No rows match the active filters. | |||||
| Title | Language | Description | Repository | Source |
|---|---|---|---|---|
| local repository and exported telemetry scope | Python | Does the telemetry scope contain patterns associated with Microsoft Defender CVE-2026-45498: KEV Platform DoS Exposure? | scripts/local_repository_and_exported_telemetry_scope.py opens in a new tab | msrc.microsoft.com |
#!/usr/bin/env python3
import os
import sys
from pathlib import Path
ROOT = sys.argv[1] if len(sys.argv) > 1 else "."
LOG_ROOT = os.environ.get("LOG_ROOT", "")
OUT = Path(os.environ.get("OUT", "hp-microsoft-defender-cve-2026-45498-kev-scope"))
# Collect unique indicators
indicators = set()
for group in []:
for val in group:
if val:
indicators.add(val)
with open(indicators_file, "w") as f:
for ind in sorted(indicators):
f.write(ind + "\n")
print(f"[+] Written unique selectors to {indicators_file}")
# Walk local directory
print(f"[+] Scanning directory: {ROOT} for selectors...")
matches = []
exclude_dirs = {"node_modules", "vendor", "dist", ".git"}
for root, dirs, filenames in os.walk(ROOT):
dirs[:] = [d for d in dirs if d not in exclude_dirs]
for filename in filenames:
filepath = Path(root) / filename
try:
content = filepath.read_text(errors="ignore")
for ind in indicators:
if ind in content:
matches.append(f"{filepath}: found '{ind}'")
except Exception:
pass # pass # return or raise not needed here # pass # return or raise not needed here # pass # return or raise not needed here
if matches:
(OUT / "repository-indicator-matches.txt").write_text("\n".join(matches) + "\n")
print(f"[!] Found {len(matches)} matches in codebase!")
# Optional Log Scanning
if LOG_ROOT and os.path.exists(LOG_ROOT):
print(f"[+] Scanning telemetry log directory: {LOG_ROOT}...")
log_matches = []
for root, _, filenames in os.walk(LOG_ROOT):
for filename in filenames:
filepath = Path(root) / filename
try:
content = filepath.read_text(errors="ignore")
for ind in indicators:
if ind in content:
log_matches.append(f"{filepath}: found '{ind}'")
except Exception:
pass # pass # return or raise not needed here # pass # return or raise not needed here # pass # return or raise not needed here
if log_matches:
(OUT / "exported-telemetry-indicator-matches.txt").write_text("\n".join(log_matches) + "\n")
print(f"[!] Found {len(log_matches)} matches in logs!")
if PACKAGES:
registry_dir = OUT / "registry"
registry_dir.mkdir(exist_ok=True)
print(f"[+] Wrote scope artifacts under {OUT}")
| Source | Type | Reliability | Claims | Evidence |
|---|---|---|---|---|
| msrc.microsoft.com | Security Researcher | 95% | 1 | CISA added Microsoft Defender CVE-2026-45498 to KEV on 2026-05-20. MSRC marks exploitation detected and gives the exact fixed Defender Antimalware Platform version 4.18.26040.7. |
| nvd.nist.gov | Security Researcher | 95% | 1 | CISA added Microsoft Defender CVE-2026-45498 to KEV on 2026-05-20. MSRC marks exploitation detected and gives the exact fixed Defender Antimalware Platform version 4.18.26040.7. |
| cisa.gov | Security Researcher | 95% | 1 | CISA added Microsoft Defender CVE-2026-45498 to KEV on 2026-05-20. MSRC marks exploitation detected and gives the exact fixed Defender Antimalware Platform version 4.18.26040.7. |