CVE-2026-45498: Defender denial of service used to blind endpoint protection

What it is

UnDefend is a tool that stops Microsoft Defender from keeping itself current. A standard, non-admin user can run it. It is not a privilege escalation. CVE-2026-45498 is the CVE Microsoft assigned to it, and the researcher confirmed the match, per The Hacker News.

Huntress describes how it works: it watches Defender’s definition-update folder and the Malicious Software Removal Tool folder, and locks new files before Defender can use them. It also locks the backup signature files at startup and again whenever the WinDefend service stops, so Defender cannot reload signatures. The effect lasts only while the UnDefend process runs.

The danger is the pairing. Huntress saw UnDefend used on the same day as RedSun, a Defender privilege-escalation exploit, after hands-on-keyboard reconnaissance (whoami /priv, cmdkey /list, net group). The Cloud Security Alliance notes the endpoint can still show as healthy in management consoles. Treat this as a way to blind detection before the next stage, not as a nuisance outage.

Related: the privilege-escalation bug CVE-2026-41091 was fixed and exploited in the same period, per The Hacker News.

Am I affected?

You are affected if Microsoft Defender is active and its Antimalware Platform is older than 4.18.26040.7. The CVE record lists 4.0.0.0 up to that build. Systems with Defender disabled are not susceptible (The Hacker News).

To check, per The Hacker News: open Windows Security > Virus & threat protection > Protection updates > Check for updates, then Settings > About and read the Antimalware Client Version.

Microsoft lists no workarounds and no mitigations for this CVE.

What to do

1. Update the platform. No manual patching is needed in the normal case: the update arrives automatically with the Defender definition and engine updates (The Hacker News). Confirm every endpoint reports 4.18.26040.7 or later.
2. Check endpoints that don’t update. Machines with blocked update channels, golden images and offline systems will lag. Verify the platform version from an independent source, not the console’s health status.
3. Restrict who can run unknown binaries. The Cloud Security Alliance suggests WDAC or AppLocker rules that block unsigned executables in user-writable folders such as Downloads and Pictures. That breaks the observed staging pattern.
4. If you find UnDefend execution, start incident response. Huntress says to treat any confirmed run as urgent. Assume an attacker already had a foothold, check for RedSun or privilege escalation, and review the VPN login that gave them access.

Detection

No hashes have been published. Hunt for what Huntress and the Cloud Security Alliance reported:

• Files named undef.exe, UnDefend.exe, z.exe, RedSun.exe or FunnyApp.exe, run from user-writable folders such as Downloads, Pictures and Desktop (see the indicators table).
• The -agressive or -aggressive argument on a process.
• Reconnaissance commands (whoami /priv, cmdkey /list, net group) shortly before an unknown binary starts.
• Repeated Windows Update error 80070643 during Defender signature updates, especially on several endpoints at once (Cloud Security Alliance).
• MsMpEng.exe failing to load or stopping unexpectedly, especially around platform updates.
• Signature versions that are stale compared with Microsoft’s feed while the console shows healthy.
• Writes to C:\Windows\System32\TieringEngineService.exe and cloud sync provider registrations containing SERIOUSLYMSFT, which the Cloud Security Alliance ties to RedSun.
• SSL VPN logins from the addresses in the indicator note, if you run FortiGate.