Threat video1:00
CISA KEV May 20, 2026: 7 Flaws, Defender CVE-2026-41091
CISA's May 20, 2026 KEV batch adds two new Microsoft Defender flaws and five legacy ones. Includes 9 detection rules, 16 IOCs and a free Splunk SPL rule.
Read the full threat intel for May 2026 CISA KEV batch →
Chapters
- 0:00The hookCatalog adds Defender flaws and legacy CVEs.
- 0:05The storyDefender escalation to SYSTEM.
- 0:11Attack pathExploit parser for SYSTEM.
- 0:24AttributionNo threat actor is attributed.
- 0:29Indicators of compromise7 indicators to hunt: 1 file name, 2 registry keys and 1 path, and more.
- 0:37MITRE ATT&CK techniques17 ATT&CK techniques, from initial access to impact.
- 0:42Remediation6 steps now: Apply Microsoft Defender Platform update.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Catalog adds Defender flaws and legacy CVEs.
0:05Defender escalation to SYSTEM.
0:07Crash disables scanning.
0:12Exploit parser for SYSTEM.
0:13SYSTEM enables evasion.
0:15Denial-of-service creates evasion window.
0:18Execute secondary loader.
0:25No threat actor is attributed. Confidence: none.
0:307 indicators to hunt: 1 file name, 2 registry keys and 1 path, and more.
0:3717 ATT&CK techniques, from initial access to impact.
0:426 steps now: Apply Microsoft Defender Platform update.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.