Microsoft Windows Defender vulnerabilities

29 CVEs affecting Microsoft Windows Defender, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-70264, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-8540: Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability, published 2017-05-26. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 71.9% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and…
• CVE-2021-1647: Microsoft Defender Remote Code Execution Vulnerability, published 2021-01-12. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 39.7% chance of exploitation in the next 30 days. Microsoft Defender Remote Code Execution Vulnerability
• CVE-2017-0290, published 2017-05-09. High severity, CVSS 7.8. EPSS: 81.4% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and…
• CVE-2018-0986, published 2018-04-04. High severity, CVSS 8.8. EPSS: 63.3% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka "Microsoft Malware…
• CVE-2017-8538, published 2017-05-26. High severity, CVSS 7.8. EPSS: 50% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and…
• CVE-2017-8541, published 2017-05-26. High severity, CVSS 7.8. EPSS: 48.1% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and…
• CVE-2017-8558, published 2017-06-29. High severity, CVSS 7.8. EPSS: 43.6% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on 32-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows…
• CVE-2006-5270, published 2007-02-13. High severity, CVSS 9.3. EPSS: 30.3% chance of exploitation in the next 30 days. Integer overflow in the Microsoft Malware Protection Engine (mpengine.dll), as used by Windows Live OneCare, Antigen, Defender, and Forefront Security, allows user-assisted remote attackers to…
• CVE-2017-8537, published 2017-05-26. Medium severity, CVSS 5.5. EPSS: 16.8% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and…
• CVE-2017-8536, published 2017-05-26. Medium severity, CVSS 5.5. EPSS: 16.8% chance of exploitation in the next 30 days. The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and…

Latest

• CVE-2026-70264, published 2026-10-13. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to disclose information locally.
• CVE-2023-36422, published 2023-11-14. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. Microsoft Windows Defender Elevation of Privilege Vulnerability
• CVE-2023-38175, published 2023-08-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Microsoft Windows Defender Elevation of Privilege Vulnerability
• CVE-2021-24092, published 2021-02-25. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Microsoft Defender Elevation of Privilege Vulnerability
• CVE-2020-1461, published 2020-07-14. High severity, CVSS 7.1. EPSS: 0.8% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to…
• CVE-2020-1170, published 2020-06-09. High severity, CVSS 7.8. EPSS: 1.6% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists in Windows Defender that leads arbitrary file deletion on the system.To exploit the vulnerability, an attacker would first have to log on to the system,…
• CVE-2020-1163, published 2020-06-09. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists in Windows Defender that leads arbitrary file deletion on the system.To exploit the vulnerability, an attacker would first have to log on to the system,…
• CVE-2020-1002, published 2020-04-15. High severity, CVSS 7.1. EPSS: 0.7% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to…
• CVE-2020-0835, published 2020-04-15. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when Windows Defender antimalware platform improperly handles hard links, aka 'Windows Defender Antimalware Platform Hard Link Elevation of Privilege…