Microsoft Defender Antimalware Platform vulnerabilities

2 CVEs affecting Microsoft Defender Antimalware Platform, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-45498, published 2026-05-20.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-45498: Microsoft Defender Denial of Service Vulnerability, published 2026-05-20. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2026-05-20. EPSS: 1.3% chance of exploitation in the next 30 days. Microsoft Defender Denial of Service Vulnerability
• CVE-2026-33825: Microsoft Defender Insufficient Granularity of Access Control Vulnerability, published 2026-04-14. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-04-22. EPSS: 0.4% chance of exploitation in the next 30 days. Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.