CTI status
As of:
Last pipeline run:
Two actively exploited vulnerabilities in Microsoft Defender compromise the endpoint protection tool itself, potentially allowing attackers to bypass core defense mechanisms.
Microsoft warns of active zero-day exploits targeting Defender components already being weaponized in attacks, requiring urgent patching and configuration remediation.
Attackers are actively exploiting Microsoft Defender vulnerabilities to bypass its protection and compromise BitLocker encryption,indicative of coordinated, sophisticated campaigns targeting Windows-based infrastructure.
BSI advisory discloses multiple vulnerabilities in Microsoft Defender and Malware Protection Engine enabling privilege escalation and remote code execution on Windows Servers , immediate patching required for production environments (WS 2022/2019).
Microsoft alerts to active exploit campaigns specifically targeting Windows Defender vulnerabilities,a direct threat to enterprises running Defender-protected endpoints.
The Yellowkey exploit allows BitLocker bypass without knowledge of the encryption key and requires manual mitigation steps beyond standard patching.
Generic BSI advisory without specific CVE identifiers, affected versions, or exploitation status; describes multiple undefined vulnerabilities without documenting active campaigns or current exploitation.
The accidental disclosure of details about an unpatched Chromium vulnerability increases the risk of exploitation by attackers before a fix is available.
SecurityWeek confirms that UnDefend and RedSun Defender zero-days were actively exploited and Microsoft has released patches, but lacks technical details or threat actor attribution.
Two Microsoft Defender vulnerabilities are being actively exploited, with one elevation of privilege (CVE-2026-41091) being particularly critical and leading to full system compromise.
A kernel bug in IPv6 RPL processing can cause memory corruption, affecting Ubuntu 24.04 LTS.