CISA KEV Catalog Adds Seven Vulnerabilities (May 20, 2026) — Microsoft Defender CVE-2026-41091 (EoP) and CVE-2026-45498 (DoS) Headline Active Exploitation Batch

CISA KEV Catalog Adds Seven Vulnerabilities (May 20, 2026) (TL-2026-0545), also tracked as CISA KEV 2026-05-20, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-05-21. It has no confirmed attribution, affects Microsoft Microsoft Defender Antimalware Platform, references 7 CVEs (CVE-2026-41091, CVE-2026-45498, CVE-2008-4250), maps to 17 MITRE ATT&CK techniques (T1003, T1021, T1055), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-0545

Threat ID
TL-2026-0545
Also known as
CISA KEV 2026-05-20, May 2026 KEV Batch, Defender EoP + DoS May 2026
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-05-21
Last reviewed
2026-05-21
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
government, defense industrial base, financial services, healthcare, energy, manufacturing, critical infrastructure
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
16

Malware and tooling in CISA KEV Catalog Adds Seven Vulnerabilities (May 20, 2026)

Malware and tooling: Brute Ratel C4 - S1063, Cobalt Strike, Defender Control / dControl.exe, SystemBC SOCKS5 proxy

On May 20, 2026, CISA added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active in-the-wild exploitation. The batch includes two new Microsoft Defender flaws — CVE-2026-41091 (Elevation of Privilege via MpClient.dll signature parser) and CVE-2026-45498 (Denial of Service via malformed scan request) — alongside five legacy vulnerabilities (CVE-2008-4250, CVE-2009-1537, CVE-2009-3459, CVE-2010-0249, CVE-2010-0806) whose continued exploitation reflects ongoing targeting of unpatched legacy estates. BOD 22-01 mandates FCEB agencies remediate by the listed due dates; the two 2026 Defender CVEs are the operational priority for modern defenders.

How CISA KEV Catalog Adds Seven Vulnerabilities (May 20, 2026) works

On May 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) published a Known Exploited Vulnerabilities (KEV) Catalog update adding seven CVEs based on confirmed evidence of in-the-wild exploitation. Inclusion in the KEV catalog triggers Binding Operational Directive (BOD) 22-01 obligations: U.S. Federal Civilian Executive Branch (FCEB) agencies must remediate the listed vulnerabilities by the assigned due date, and the catalog is widely adopted as the de facto patch prioritization standard across critical infrastructure, private sector, and allied governments.

The two newly disclosed 2026 vulnerabilities — both affecting Microsoft Defender — represent the immediate operational priority. CVE-2026-41091 is an Elevation of Privilege flaw in the Microsoft Defender Antimalware Service (MsMpEng.exe / MpClient.dll) signature deserialization path. A locally authenticated, low-privileged user can stage a crafted on-disk artifact that, when consumed by the Defender real-time scanning engine, triggers a type-confusion condition in the signature parser. Because the scanning engine runs as NT AUTHORITY\SYSTEM, successful exploitation yields full SYSTEM privileges on the host. The technique is amenable to chaining with browser or Office sandbox escapes and has been observed used post-initial-access by intrusion sets operating against U.S. and EU enterprise targets.

CVE-2026-45498 is a Denial-of-Service in the same component reachable via a malformed scan request to the MpsSvc named-pipe interface or via crafted file content evaluated during synchronous on-access scanning. Triggering the bug crashes MsMpEng.exe; on hosts with Tamper Protection and watchdog recovery enabled the service restarts, but repeated triggering produces a sustained scan-evasion window during which attacker payloads execute without antimalware coverage. Observed tradecraft pairs CVE-2026-45498 with execution of secondary loaders (Cobalt Strike, Brute Ratel, SystemBC) immediately after the Defender crash window opens.

The five legacy CVEs reflect persistent exploitation against unpatched legacy estates and air-gapped or sanctioned-region networks where Microsoft Update has not been applied: CVE-2008-4250 (MS08-067 NetAPI32.dll path-canonicalization remote code execution — the Conficker worm vector, still observed against legacy Windows XP/2003 manufacturing and OT estates), CVE-2009-1537 (DirectX DirectShow QuickTime parser NULL-byte overwrite), CVE-2009-3459 (Adobe Acrobat/Reader U3D heap overflow), CVE-2010-0249 (Internet Explorer 'Aurora' use-after-free — original Operation Aurora vector attributed to APT17/Elderwood, still observed in commodity malware kits targeting legacy thin clients), and CVE-2010-0806 (Internet Explorer iepeers.dll use-after-free).

Exploit chain for the Defender EoP (CVE-2026-41091): (1) initial access via phishing or web exploit, (2) low-privileged code execution as a standard user, (3) attacker writes a crafted file to a path scanned by Defender real-time protection, (4) Defender's signature parser deserializes attacker-controlled type metadata, (5) type confusion permits arbitrary read/write within the Defender process, (6) attacker pivots to SYSTEM and disables further Defender protections, (7) follow-on tooling (C2 beacon, credential dump) executes without antimalware coverage.

For the Defender DoS (CVE-2026-45498): (1) attacker establishes any code execution context, (2) sends malformed IPC payload to MpsSvc or stages crafted content evaluated by synchronous scanning, (3) MsMpEng.exe crashes, (4) attacker race-executes secondary payload within the recovery window, (5) cycle repeats to sustain scan-evasion.

Remediation: apply Microsoft Defender platform updates (Defender Platform 4.18.26050.x and later) and signature build 1.421.x or higher; verify Tamper Protection is enabled; ensure ASR rules covering 'Block credential stealing' and 'Block process creations originating from PSExec/WMI' are in audit-then-enforce mode; for the legacy CVEs, prioritize replacement or strict network segmentation of any remaining Windows XP/Server 2003 and unpatched IE/Adobe Reader endpoints; monitor MsMpEng.exe crash events (Event ID 7031/7034 in System log, Defender Operational log 5007).

MITRE ATT&CK techniques used in TL-2026-0545

Credential Access

T1003 OS Credential Dumping

Lateral Movement

T1021 Remote Services

Defense Evasion

T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Command and Control

T1071 Application Layer Protocol

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Initial Access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution; T1204 User Execution

Impact

T1489 Service Stop

Persistence

T1547 Boot or Logon Autostart Execution

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in CISA KEV Catalog Adds Seven Vulnerabilities (May 20, 2026)

  • Microsoft — Microsoft Defender Antimalware Platform
    Vulnerable versions: Platform < 4.18.26050.x; Signature Build < 1.421.x
    Fixed in: Platform 4.18.26050.x; Signature Build 1.421.x and later
  • Microsoft — Microsoft Defender for Endpoint
    Vulnerable versions: Antimalware client < 4.18.26050.x on Windows 10/11/Server 2016-2025
    Fixed in: Antimalware client 4.18.26050.x+
  • Microsoft — Windows (legacy)
    Vulnerable versions: Windows 2000 SP4; Windows XP SP2/SP3; Windows Server 2003
    Fixed in: MS08-067 patched builds
  • Microsoft — DirectX / DirectShow
    Vulnerable versions: DirectX 7.0; DirectX 8.1; DirectX 9.0c on Windows 2000/XP/Server 2003
    Fixed in: MS09-028 patched builds
  • Adobe — Acrobat and Reader
    Vulnerable versions: Acrobat/Reader 9.1.3 and earlier; 8.1.6 and earlier; 7.1.3 and earlier
    Fixed in: Acrobat/Reader 9.2 (APSB09-15)
  • Microsoft — Internet Explorer
    Vulnerable versions: IE 6 SP1; IE 6 / IE 7 / IE 8 on Windows XP/Server 2003/Vista/7
    Fixed in: MS10-002 and MS10-018 patched builds

Remediation for CISA KEV Catalog Adds Seven Vulnerabilities (May 20, 2026)

Patches

  • Microsoft Defender Platform 4.18.26050.x (Windows Update)
  • Microsoft Defender Antimalware Signature Build 1.421.x or later
  • MS08-067 (legacy — CVE-2008-4250)
  • MS09-028 (legacy — CVE-2009-1537)
  • APSB09-15 (legacy — CVE-2009-3459)
  • MS10-002 (legacy — CVE-2010-0249)
  • MS10-018 (legacy — CVE-2010-0806)

Immediate actions

  • Apply Microsoft Defender Platform update 4.18.26050.x or later via Windows Update or Microsoft Update Catalog
  • Update Microsoft Defender Antimalware Client to build 4.18.26050.x and Signature Build 1.421.x+
  • Verify Tamper Protection is enabled in Microsoft Defender Endpoint policy
  • Enable ASR rules: 'Block credential stealing from LSASS', 'Block process creations from PSExec/WMI commands', 'Block executable content from email/webmail'
  • Hunt MsMpEng.exe crash events: System log Event ID 7031/7034, Application log Event ID 1000 with faulting module MpClient.dll or mpengine.dll
  • Review Defender Operational log for Event ID 5007 (configuration change) and 1116/1117 (malware detected) immediately preceding service crashes

Workarounds

  • If patch deployment is delayed: disable real-time on-access scanning on file servers handling untrusted uploads and rely on scheduled scans plus EDR (interim only)
  • Apply network segmentation to legacy unpatched Windows XP/2003 hosts; remove from production routable VLANs
  • Disable IE rendering and Adobe Reader plugin execution on remaining legacy endpoints
  • Block SMB (TCP 445) on perimeter and segment internal SMB to mitigate residual MS08-067 risk

Longer-term hardening

  • Establish KEV catalog ingestion into vulnerability management with automated SLA enforcement aligned to BOD 22-01 due dates
  • Decommission or strictly segment Windows XP, Server 2003, and other Microsoft Extended Security Update-expired hosts
  • Deploy second-tier EDR (CrowdStrike, SentinelOne, Defender for Endpoint with Network Protection) so a single AV crash does not yield scan-evasion windows
  • Implement Windows Defender Application Control (WDAC) or AppLocker to reduce reliance on signature-based detection
  • Onboard Defender telemetry to Microsoft Defender XDR / Sentinel for behavioral and crash-pattern detection

CVEs associated with CISA KEV Catalog Adds Seven Vulnerabilities (May 20, 2026)

CVE-2026-41091, CVE-2026-45498, CVE-2008-4250, CVE-2009-1537, CVE-2009-3459, CVE-2010-0249, CVE-2010-0806

Weaknesses (CWE) in CISA KEV Catalog Adds Seven Vulnerabilities (May 20, 2026)

CWE-269, CWE-400, CWE-416, CWE-122, CWE-119, CWE-843, CWE-502

Timeline of CISA KEV Catalog Adds Seven Vulnerabilities (May 20, 2026)

  • Microsoft releases MS08-067 disclosing CVE-2008-4250 NetAPI32.dll RCE; subsequently weaponized by Conficker worm in late 2008.
  • Google publicly discloses Operation Aurora intrusion campaign exploiting CVE-2010-0249 (Internet Explorer use-after-free) attributed to APT17/Elderwood.
  • Microsoft releases MS10-018 patching CVE-2010-0806 IE iepeers.dll use-after-free.
  • Microsoft Patch Tuesday May 2026 ships Defender Platform update addressing CVE-2026-41091 and CVE-2026-45498.
  • Incident response engagements report in-the-wild exploitation of CVE-2026-41091 as a post-initial-access SYSTEM escalation primitive paired with Cobalt Strike loader execution.
  • CISA adds CVE-2026-41091, CVE-2026-45498, and five legacy CVEs (CVE-2008-4250, CVE-2009-1537, CVE-2009-3459, CVE-2010-0249, CVE-2010-0806) to the Known Exploited Vulnerabilities catalog under BOD 22-01.
  • As of 2026-05-29, this is a live concern: Huntress/Microsoft confirm CVE-2026-41091 (Defender EoP) and CVE-2026-45498 (DoS) actively exploited in the wild, with the BOD 22-01 KEV remediation deadline (June 3, 2026) still pending. Patches ship via Defender auto-update (Platform 1.1.26040.8/4.18.26040.7+), but the five legacy CVEs remain exploited against unpatched estates.
  • BOD 22-01 remediation deadline for FCEB agencies (21 days from KEV addition).

Sources cited for CISA KEV Catalog Adds Seven Vulnerabilities (May 20, 2026)

Threats related to CISA KEV Catalog Adds Seven Vulnerabilities (May 20, 2026)

Detection coverage for TL-2026-0545

As of 2026-05-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0545 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats