{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "microsoft-defender-attacked-bugs-2026",
  "url": "https://patchgap.ai/incidents/microsoft-defender-attacked-bugs-2026/",
  "path": "/incidents/microsoft-defender-attacked-bugs-2026/",
  "json_url": "https://patchgap.ai/incidents/microsoft-defender-attacked-bugs-2026.json",
  "title": "Windows: three bugs in Microsoft Defender, the built-in antivirus, were used in real attacks",
  "category": "windows",
  "platforms": [
   "windows"
  ],
  "products": [
   "windows"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
  "exploited_in_wild": "yes",
  "exploited_note": "CISA lists all three as used in real attacks (added Apr 22 and May 20, 2026).",
  "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-04-14",
  "updated_at": "2026-10-27",
  "cves": [
   "CVE-2026-33825",
   "CVE-2026-41091",
   "CVE-2026-45498"
  ],
  "summary": "Microsoft Defender is the antivirus built into Windows. Three bugs in it let a bad program that is already on your PC take more control, or stop Defender from working. Microsoft fixed them in April and May 2026. Defender normally updates itself in the background.",
  "am_i_affected": "You are at risk only if Defender has not updated since May 2026. Open Windows Security > Virus & threat protection > Protection updates and click Check for updates. If it finds nothing new, you are covered.",
  "action": "Check for Defender updates in Windows Security",
  "affected": [
   {
    "product": "windows",
    "product_name": "Windows 10 and 11",
    "platform": "windows",
    "affected_versions": "Microsoft Defender on Windows 10 and 11 without the April and May 2026 Defender updates",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Fixed by Microsoft Defender updates released in April 2026 (CVE-2026-33825) and May 2026 (the other two). Defender installs these by itself; Microsoft's pages list the fixed Defender versions.",
    "fixed_source_urls": [
     "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825",
     "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091",
     "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498"
    ],
    "check": {
     "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
     "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
   }
  ],
  "fix_steps": [
   "Open Start and type Windows Security, then open it.",
   "Click Virus & threat protection.",
   "Under Virus & threat protection updates, click Protection updates.",
   "Click Check for updates.",
   "Also run Windows Update (Settings > Windows Update) and restart if asked."
  ],
  "official_patch_links": [
   {
    "label": "Microsoft: how to update Windows",
    "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
   },
   {
    "label": "Microsoft: CVE-2026-41091 details",
    "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825",
    "title": "Microsoft Security Update Guide: CVE-2026-33825 (April 2026 update)",
    "date": "2026-04-14",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091",
    "title": "Microsoft Security Update Guide: CVE-2026-41091 (May 2026 update)",
    "date": "2026-05-12",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498",
    "title": "Microsoft Security Update Guide: CVE-2026-45498 (May 2026 update)",
    "date": "2026-05-12",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-33825 (added 2026-04-22)",
    "date": "2026-04-22",
    "kind": "cisa",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-41091, CVE-2026-45498 (added 2026-05-20)",
    "date": "2026-05-20",
    "kind": "cisa",
    "official": true
   }
  ]
 }
}