Microsoft Defender known exploited vulnerabilities, ranked
CISA lists 5 Microsoft Defender CVEs as exploited in the wild. 3 were added in the last 12 months and 2 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2022-44698: EPSS 76.3%, used in ransomware, added 2022-12-13
- CVE-2021-1647: EPSS 39.4%, added 2021-11-03
- CVE-2026-45498: EPSS 1.3%, added 2026-05-20
- CVE-2026-41091: EPSS 0.4%, added 2026-05-20
- CVE-2026-33825: EPSS 0.4%, used in ransomware, added 2026-04-22
All 5 Microsoft Defender CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2022-44698 | Defender SmartScreen Security Feature Bypass | 76.3% | Yes | 2022-12-13 | 2023-01-03 |
| 2 | CVE-2021-1647 | Defender Remote Code Execution | 39.4% | – | 2021-11-03 | 2021-11-17 |
| 3 | CVE-2026-45498 | Defender Denial of Service | 1.3% | – | 2026-05-20 | 2026-06-03 |
| 4 | CVE-2026-41091 | Defender Link Following | 0.4% | – | 2026-05-20 | 2026-06-03 |
| 5 | CVE-2026-33825 | Defender Insufficient Granularity of Access Control | 0.4% | Yes | 2026-04-22 | 2026-05-06 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Microsoft KEV CVEs · other Microsoft products: SharePoint · Windows · SharePoint Server · Internet Explorer · Office · Exchange Server · Win32k · free KEV badge for Microsoft · all vendors