CVE-2026-122194: Microsoft Defender Remote Code Execution Vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is rated network-accessible with low attack complexity and requires no privileges. The vector also indicates user interaction is required.

Q: What could exploitation allow?

Successful exploitation could allow an unauthorized attacker to execute code, with high potential impact to confidentiality, integrity, and availability.

Q: Which component should be investigated for exposure?

The affected software identified is the Microsoft Malware Protection Engine. Review systems using this engine and consult the Microsoft security update guidance referenced for CVE-2026-122194.

Published Nov 10, 2026

Updated

Microsoft Defender Remote Code Execution Vulnerability

Other sources

Null pointer dereference in Microsoft Defender allows an unauthorized attacker to execute code over a network.

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Malware Protection Engine<1.1.26100.4

1.1.26100.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.1.26100.4

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:21 PM

Data Sourced

via MITRE·06:21 PM

DescriptionSeverity

Data Sourced

via NVD·07:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is rated network-accessible with low attack complexity and requires no privileges. The vector also indicates user interaction is required.

What could exploitation allow?

Successful exploitation could allow an unauthorized attacker to execute code, with high potential impact to confidentiality, integrity, and availability.

Which component should be investigated for exposure?

The affected software identified is the Microsoft Malware Protection Engine. Review systems using this engine and consult the Microsoft security update guidance referenced for CVE-2026-122194.

CVE-2026-122194: Microsoft Defender Remote Code Execution Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What could exploitation allow?

Which component should be investigated for exposure?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What could exploitation allow?

Which component should be investigated for exposure?