Microsoft Malware Protection Engine vulnerabilities

31 CVEs affecting Microsoft Malware Protection Engine, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-69414, published 2026-08-14.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-8540: Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability, published 2017-05-26. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 71.9% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and…
• CVE-2026-41091: Microsoft Defender Link Following Vulnerability, published 2026-05-20. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-05-20. EPSS: 0.4% chance of exploitation in the next 30 days. Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
• CVE-2017-0290, published 2017-05-09. High severity, CVSS 7.8. EPSS: 81.4% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and…
• CVE-2017-8538, published 2017-05-26. High severity, CVSS 7.8. EPSS: 50% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and…
• CVE-2017-8541, published 2017-05-26. High severity, CVSS 7.8. EPSS: 48.1% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and…
• CVE-2006-5270, published 2007-02-13. High severity, CVSS 9.3. EPSS: 30.3% chance of exploitation in the next 30 days. Integer overflow in the Microsoft Malware Protection Engine (mpengine.dll), as used by Windows Live OneCare, Antigen, Defender, and Forefront Security, allows user-assisted remote attackers to…
• CVE-2017-11937, published 2017-12-07. High severity, CVSS 7.8. EPSS: 28.3% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows…
• CVE-2017-11940, published 2017-12-08. High severity, CVSS 7.8. EPSS: 19.8% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows…
• CVE-2014-2779, published 2014-06-18. Medium severity, CVSS 4.3. EPSS: 13.4% chance of exploitation in the next 30 days. mpengine.dll in Microsoft Malware Protection Engine before 1.1.10701.0 allows remote attackers to cause a denial of service (system hang) via a crafted file.
• CVE-2008-1438, published 2008-05-13. Medium severity, CVSS 5.0. EPSS: 12.9% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial…

Latest

• CVE-2026-69414, published 2026-08-14. High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days. Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
• CVE-2026-55012, published 2026-07-14. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.
• CVE-2026-55011, published 2026-07-14. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally.
• CVE-2026-50656, published 2026-06-16. High severity, CVSS 7.0. EPSS: 0.4% chance of exploitation in the next 30 days. Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".
• CVE-2026-45584, published 2026-05-20. High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.
• CVE-2023-33156, published 2023-07-11. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. Microsoft Defender Elevation of Privilege Vulnerability
• CVE-2023-24860, published 2023-04-11. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. Microsoft Defender Denial of Service Vulnerability
• CVE-2023-23389, published 2023-03-14. Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days. Microsoft Defender Elevation of Privilege Vulnerability
• CVE-2022-37971, published 2022-10-11. High severity, CVSS 7.1. EPSS: 0.7% chance of exploitation in the next 30 days. Microsoft Windows Defender Elevation of Privilege Vulnerability