cve 2026 45584

CVE-2026-45584 is a critical remote code execution vulnerability in the Microsoft Malware Protection Engine, which powers Microsoft Defender and other antimalware products. Disclosed on May 19, 2026, the flaw affects engine versions through 1.1.26030.3008 and is fixed in version 1.1.26040.8. While Microsoft states that default automatic updates should deploy the patch without administrator intervention, the tag content highlights that enterprise IT teams cannot rely solely on automatic updates. The real challenge is verifying that every endpoint has received the updated engine. This vulnerability underscores that Defender is not just an application but a deeply integrated scanning engine within Windows security infrastructure.