# CISA KEV Catalog Adds Seven Vulnerabilities (May 20, 2026) — Microsoft Defender CVE-2026-41091 (EoP) and CVE-2026-45498 (DoS) Headline Active Exploitation Batch

> On May 20, 2026, CISA added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active in-the-wild exploitation. The batch includes two new Microsoft Defender flaws — CVE-2026-41091 (Elevation of Privilege via MpClient.dll signature parser) and CVE-2026-45498 (Denial of Service via malformed scan request) — alongside five legacy vulnerabilities (CVE-2008-4250, CVE-2009-1537, CVE-2009-3459, CVE-2010-0249, CVE-2010-0806) whose continued exploitation reflects ongoing targeting of unpatched legacy estates. BOD 22-01 mandates FCEB agencies remediate by the listed due dates; the two 2026 Defender CVEs are the operational priority for modern defenders.

- **Published:** 2026-05-21T12:00:00Z
- **Last reviewed:** 2026-05-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0545
- **ID:** TL-2026-0545
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41091, CVE-2026-45498, CVE-2008-4250, CVE-2009-1537, CVE-2009-3459, CVE-2010-0249, CVE-2010-0806

## Description

On May 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) published a Known Exploited Vulnerabilities (KEV) Catalog update adding seven CVEs based on confirmed evidence of in-the-wild exploitation. Inclusion in the KEV catalog triggers Binding Operational Directive (BOD) 22-01 obligations: U.S. Federal Civilian Executive Branch (FCEB) agencies must remediate the listed vulnerabilities by the assigned due date, and the catalog is widely adopted as the de facto patch prioritization standard across critical infrastructure, private sector, and allied governments.

The two newly disclosed 2026 vulnerabilities — both affecting Microsoft Defender — represent the immediate operational priority. CVE-2026-41091 is an Elevation of Privilege flaw in the Microsoft Defender Antimalware Service (MsMpEng.exe / MpClient.dll) signature deserialization path. A locally authenticated, low-privileged user can stage a crafted on-disk artifact that, when consumed by the Defender real-time scanning engine, triggers a type-confusion condition in the signature parser. Because the scanning engine runs as NT AUTHORITY\SYSTEM, successful exploitation yields full SYSTEM privileges on the host. The technique is amenable to chaining with browser or Office sandbox escapes and has been observed used post-initial-access by intrusion sets operating against U.S. and EU enterprise targets.

CVE-2026-45498 is a Denial-of-Service in the same component reachable via a malformed scan request to the MpsSvc named-pipe interface or via crafted file content evaluated during synchronous on-access scanning. Triggering the bug crashes MsMpEng.exe; on hosts with Tamper Protection and watchdog recovery enabled the service restarts, but repeated triggering produces a sustained scan-evasion window during which attacker payloads execute without antimalware coverage. Observed tradecraft pairs CVE-2026-45498 with execution of secondary loaders (Cobalt Strike, Brute Ratel, SystemBC) immediately after the Defender crash window opens.

The five legacy CVEs reflect persistent exploitation against unpatched legacy estates and air-gapped or sanctioned-region networks where Microsoft Update has not been applied: CVE-2008-4250 (MS08-067 NetAPI32.dll path-canonicalization remote code execution — the Conficker worm vector, still observed against legacy Windows XP/2003 manufacturing and OT estates), CVE-2009-1537 (DirectX DirectShow QuickTime parser NULL-byte overwrite), CVE-2009-3459 (Adobe Acrobat/Reader U3D heap overflow), CVE-2010-0249 (Internet Explorer 'Aurora' use-after-free — original Operation Aurora vector attributed to APT17/Elderwood, still observed in commodity malware kits targeting legacy thin clients), and CVE-2010-0806 (Internet Explorer iepeers.dll use-after-free).

Exploit chain for the Defender EoP (CVE-2026-41091): (1) initial access via phishing or web exploit, (2) low-privileged code execution as a standard user, (3) attacker writes a crafted file to a path scanned by Defender real-time protection, (4) Defender's signature parser deserializes attacker-controlled type metadata, (5) type confusion permits arbitrary read/write within the Defender process, (6) attacker pivots to SYSTEM and disables further Defender protections, (7) follow-on tooling (C2 beacon, credential dump) executes without antimalware coverage.

For the Defender DoS (CVE-2026-45498): (1) attacker establishes any code execution context, (2) sends malformed IPC payload to MpsSvc or stages crafted content evaluated by synchronous scanning, (3) MsMpEng.exe crashes, (4) attacker race-executes secondary payload within the recovery window, (5) cycle repeats to sustain scan-evasion.

Remediation: apply Microsoft Defender platform updates (Defender Platform 4.18.26050.x and later) and signature build 1.421.x or higher; verify Tamper Protection is enabled; ensure ASR rules covering 'Block credential stealing' and 'Block process creations originating from PSExec/WMI' are in audit-then-enforce mode; for the legacy CVEs, prioritize replacement or strict network segmentation of any remaining Windows XP/Server 2003 and unpatched IE/Adobe Reader endpoints; monitor MsMpEng.exe crash events (Event ID 7031/7034 in System log, Defender Operational log 5007).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1055 Process Injection
- T1140 Deobfuscate/Decode Files or Information
- T1003 OS Credential Dumping
- T1518 Software Discovery
- T1082 System Information Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1489 Service Stop

## Sources

- [CISA Adds Seven Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/05/20/cisa-adds-seven-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Binding Operational Directive 22-01](https://www.cisa.gov/news-events/directives/binding-operational-directive-22-01)
- [Microsoft Security Update Guide — CVE-2026-41091](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091)
- [Microsoft Security Update Guide — CVE-2026-45498](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498)
- [Microsoft Defender Antimalware Platform Update Process](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-updates)
- [NVD — CVE-2026-41091](https://nvd.nist.gov/vuln/detail/CVE-2026-41091)
- [NVD — CVE-2026-45498](https://nvd.nist.gov/vuln/detail/CVE-2026-45498)
- [MS08-067 — Vulnerability in Server Service Could Allow Remote Code Execution (CVE-2008-4250)](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067)
- [MS10-002 — Cumulative Security Update for Internet Explorer (CVE-2010-0249 Aurora)](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0545