[KEV] CVE-2026-45498 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-45498 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-45498 is a denial-of-service vulnerability in Microsoft Defender, the endpoint protection and antimalware platform included with Windows and available as a standalone enterprise security product.

Technical Detail

The specific flaw mechanism has not been publicly disclosed by Microsoft at this time, and the vulnerability is described as unspecified in available advisories. An attacker who successfully exploits this vulnerability can cause Microsoft Defender to become unavailable or non-functional, which would degrade endpoint protection on affected systems. The practical consequence of a successful denial-of-service against a security product is the potential removal of a defensive control, which may be used as a precursor step in a broader attack chain.

Exploitation Status

CISA has confirmed active exploitation in the wild, adding this vulnerability to the Known Exploited Vulnerabilities catalog on May 20, 2026. The exploit maturity is rated Operational, meaning functional exploit code exists and is being used in real-world attacks, not merely demonstrated in a controlled research environment.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. The absence of attribution data does not reduce the urgency given CISA's confirmation of active exploitation.

What To Do

Per CISA's Binding Operational Directive 22-01, federal civilian executive branch agencies are required to apply available patches or mitigations by the deadline associated with the May 20, 2026 KEV listing. All organizations should treat this as a high-priority remediation regardless of the CVSS score of 0.0, which likely reflects incomplete scoring data rather than low actual risk. Apply any available Microsoft Defender updates immediately through Windows Update, Microsoft Update Catalog, or enterprise patch management tooling. Verify that Defender signature and platform update mechanisms are functioning correctly on all endpoints. Monitor for indicators of Defender service disruption or unexpected process termination, which may signal exploitation attempts in your environment.