CVE-2026-45498: Microsoft Defender antimalware platform uncontrolled resource consumption DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a remotely reachable, unauthenticated availability flaw with confirmed exploitation in CISA KEV and very high EPSS, though it causes only denial of service.

What it is

CVE-2026-45498 is a denial of service flaw in the Microsoft Defender antimalware platform, classified as uncontrolled resource consumption (CWE-400). It is remotely reachable without authentication or user interaction, and CISA has added it to the Known Exploited Vulnerabilities catalog, so it is being exploited in the wild.

Impact

An attacker can exhaust resources on a host running the affected Defender platform, degrading or disabling endpoint protection and causing a denial of service. No confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

The CVSS vector is network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), so the flaw is reachable remotely over the network without credentials or a victim action. The record does not specify the exact protocol or component within the Defender platform that is reached.

Exploitation

CISA added it to KEV on 2026-05-20 with a remediation due date of 2026-06-03, confirming known exploitation. EPSS gives a 30-day probability of 0.63076 (99.2nd percentile), indicating high predicted exploitation activity; no ransomware campaign use is documented.

What to do

• Apply the Microsoft update per the MSRC advisory for CVE-2026-45498 as the first action.
• Follow CISA BOD 22-01 guidance for cloud services and meet the 2026-06-03 KEV remediation deadline.
• If no mitigation is available, discontinue use of the affected product as CISA directs.
• Restrict network exposure of Defender management and update channels to trusted sources only.
• Monitor Defender service health and resource consumption for signs of exhaustion after patching.

Detection

• Alert on abnormal CPU, memory or handle consumption by Defender platform processes on endpoints and servers.
• Monitor for Defender service crashes, restarts or protection gaps in endpoint telemetry.
• Correlate network traffic to Defender components with spikes in resource usage on the same host.
• Track KEV status and vendor advisories for updated exploitation details as they emerge.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.