2 New Microsoft Defender Zero-Days Exploited—Patch Now Rolling Out

InnovationCybersecurity2 New Microsoft Defender Zero-Days Exploited—Patch Now Rolling OutByDavey Winder,Senior Contributor.Forbes contributors publish independent expert analyses and insights. Davey Winder is a veteran cybersecurity writer, hacker and analyst.Follow AuthorMay 21, 2026, 08:40am EDT--:-- / --:--This voice experience is generated by AI. Learn more.This voice experience is generated by AI. Learn more.Microsoft and CISA confirm Defender zero-days exploited in the wild.GettyMicrosoft has started rolling out an emergency security update for Microsoft Defender after the U.S. Cybersecurity and Infrastructure Security Agency confirmed that two new zero-day vulnerabilities are already being exploited in the wild by attackers. One is a privilege escalation problem that affects the Microsoft Malware Protection Engine, while the other has a broader scope, affecting Microsoft Defender Antimalware Platform and Microsoft's System Center Endpoint Protection. Here’s what you need to know about CVE-2026-41091 and CVE-2026-45498, including the mitigation measures confirmed by Microsoft.ForbesHow To Mitigate The Microsoft Windows BitLocker YellowKey USB 0-DayBy Davey WinderMicrosoft Defender CVE-2026-41091 And CVE-2026-45498 Zero-Days ExplainedMicrosoft has now confirmed two new Microsoft Defender zero-days that it said had been exploited. This exploitation was confirmed by CISA, which has added the security flaws to its Known Exploited Vulnerabilities catalog and given federal agencies until June 3 to ensure mitigation measures are in place. It has not been the greatest few days for Microsoft on the security front, especially regarding zero-day vulnerabilities. Microsoft Exchange users have been warned about an active zero-day exploit demanding emergency mitigation, the now infamous ‘angry hacker’ dropped another two public zero-day exploits, and the Pwn2Own Berlin hacking event uncovered numerous Windows zero-days. All within the space of a week. The first has a C...