Unable to update Windows Defender to fix vulnerability CVE-2026-41091.

Question

Hello, in our vulnerability scanner there's information on presence of CVE-2026-41091. We've attempted to update the signatures using method detailed here: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091

This unfortunately did not work.

There is another AV present on devices and Windows Defender is not registered in WSC.

Devices have Windows 11 Pro and Enterprise installed.

Answer 1

CVE-2026-41091 is fixed in Microsoft Defender Antivirus Engine 1.1.26040.8. The current release notes list that fix explicitly.

Because another antivirus is present and Microsoft Defender Antivirus is not registered in Windows Security Center, that is the key blocker. When a non-Microsoft antivirus uses the WSC API, it disables Microsoft Defender Antivirus. When Microsoft Defender Antivirus is disabled, updates can’t occur.

For the affected Windows 11 Pro and Enterprise devices, use this troubleshooting path:

1. Confirm the installed Defender versions
   • Check whether the device has at least:
     • Platform 4.18.26040.7
     • Engine 1.1.26040.8
   • If the engine is older than 1.1.26040.8, the CVE remains unpatched.
2. Address the third-party AV conflict first
   • Since Defender is not the primary antivirus and not registered in WSC, Defender updates will not occur while that condition remains.
   • The documented behavior is that a non-Microsoft antivirus registered through WSC disables Microsoft Defender Antivirus.
3. If Defender is intended to be updated, make Defender the primary antivirus
   • After the third-party AV no longer disables Defender, verify Defender services are running.
   • Then test a manual security intelligence update by downloading and installing updates from: https://www.microsoft.com/wdsi/defenderupdates
4. If manual update works, test update through MMPC using an elevated Command Prompt
   • The documented guidance is to use MpCmdRun from an elevated Command Prompt after changing to the latest Defender platform folder under: %ProgramData%\Microsoft\Windows Defender\Platform\<antimalware platform version>
   • If that path does not exist, use: %ProgramFiles%\Microsoft Defender
5. If MpCmdRun works but normal updating still fails, check update source configuration
   • Verify required Defender update URLs are allowed through the firewall or proxy.
   • Make sure those URLs are not SSL inspected.
   • Confirm these services are started:
     • Windows Update
     • Background Intelligence Transfer Service (BITS)
   • If a fallback order policy is used, make sure Microsoft Update (MicrosoftUpdateServer) is first.
   • If WSUS is configured, verify the WSUS server has approved Security intelligence updates, including KB2267602 for MDAV.
   • If a UNC share is configured as an update source, verify it is not stale.
6. If the scanner still reports the CVE after updating
   • Re-scan after confirming the device is actually on Engine 1.1.26040.8 or later.
   • The release notes tie the CVE fix to the engine version, not just to signature currency.

Important: changing WSUS settings or registry-based Windows Update policy can affect device update behavior. Validate those changes before broad deployment.

---

• Microsoft Defender for Endpoint release notes
• Troubleshoot Microsoft Defender Antivirus Security intelligence not getting updated
• Troubleshooting Security Intelligence Updates from Microsoft Update source
• Windows Defender update - Microsoft Q&A

Answer 2

Hello,

CVE-2026-41091 is fixed by updating the Microsoft Defender Antivirus engine, not only the security intelligence/signatures.

First, run PowerShell as administrator and check:

Get-MpComputerStatus | Select AMEngineVersion, AMProductVersion, AMRunningMode

Compare the installed engine version with the fixed version listed here: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091

Since another antivirus is installed and Microsoft Defender is not registered in Windows Security Center, Defender may be disabled/passive and therefore unable to update its engine normally.

Microsoft explains the behavior with third-party antivirus here: https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility

If possible, temporarily disable/uninstall the third-party antivirus, restart Windows, run Windows Update and then update Defender again.

If the Defender engine is already at or above the fixed version but the vulnerability scanner still reports CVE-2026-41091, perform a new vulnerability scan. The scanner may still be detecting an older inactive Defender component.