New Update Security Intelligence Updates in Microsoft Defender (Threat Detection Changelog)

  • Like
  • +Reputation
Reactions: harlan4096, Gandalf_The_Grey, SeriousHoax and 2 others
Release notes for latest update (above post).

Enhancements and features​


  • Improved performance for Control Folder Access (CFA) when protected folders don't include network folders.
  • Fixed proxy issue in the MdeNpDiag utility in the MDEClientAnalyzer support tool.
  • Fixed an issue where syntax errors for contextual exclusions could lead to an engine crash.
  • Fixed policy incompatibility that prevented unblocking engine updates.
  • Fixed regression in the registry service path for the Core service.
  • Improved detection in OLEstream objects.
  • Fixed race condition during service initialization to read Tamper protection status.
Click to expand...
Microsoft Defender for Endpoint release notes - Microsoft Defender for Endpoint *
* Note: MS changed the site for release notes.
 
  • Like
  • +Reputation
Reactions: Halp2001, Zartarra, lokamoka820 and 3 others
Stable channel updates:

  • Antimalware Client Version: 4.18.26020.6
  • Engine Version: 1.1.26020.3

Enhancements and features​

  • Improved the network protection feature to promptly release closed connections and reduce unnecessary memory usage.
  • Fixed an issue where the Get-MpComputerStatus PowerShell cmdlet could fail after updates due to a configuration mismatch.
  • Improved performance for Network Response Intelligence (NRI) by reducing CPU usage during high-volume asynchronous message processing.
  • Added support for AMSI path exclusions for Exchange Server so configured path exclusions are now correctly evaluated during AMSI scanning for Exchange workloads.
  • Improved policy refresh behavior for device control by updating default policy and Azure AD refresh intervals to reduce retry frequency.
Click to expand...
learn.microsoft.com

Microsoft Defender for Endpoint release notes - Microsoft Defender for Endpoint

This article describes releases of Microsoft Defender for Endpoint on Windows, macOS, Linux, Android, and iOS.
learn.microsoft.com
 
  • +Reputation
  • Like
Reactions: Gandalf_The_Grey, Pat MacKnife, harlan4096 and 3 others
Broad Channel update:
  • Platform version: 4.18.26030.3011
  • Engine version : 1.1.26030.3008

Enhancements and features​

  • Fixed a bug where Antimalware Scan Interface (AMSI) scan calls weren't passing exclusions in the scan configuration, causing unnecessary scans on excluded content.
  • Fixed deadlocks in the platform that occur during remote procedure calls (RPC).
  • Fixed a bug where Microsoft Protection Antimalware (MPAM) packages downloaded for direct update from Microsoft Malware Protection Center (MMPC) aren't cleaned up when the update fails, leading to unnecessary disk usage over time.
  • Improved quick scan error handling logic to avoid scan interruptions due to corrupted user registry hive.
  • Fixed tamper protection exclusions not activating after transitioning existing devices from co-management to full Intune management.
  • Fixed Network Inspection Service (NisSrv) ESP reputation mode checks to avoid blocks during service shutdown, which impact Remote Desktop Protocol (RDP) sessions.
  • Fixed the Defender Core Service display name in the Windows Services console.
  • Fixed NisSrv self-healing when the service crosses memory thresholds.
  • Improved encrypted PDF scanning.
  • Fixed Get-MpPerformanceReport JSON parsing failures.
Click to expand...
Microsoft Defender for Endpoint release notes - Microsoft Defender for Endpoint

Beta channel update:
  • Antimalware Client Version: 4.18.26040.7
  • Engine Version: 1.1.26040.6
 
Last edited:
  • Like
  • +Reputation
Reactions: Sunqfu, harlan4096, lokamoka820 and 6 others
Stable channel updates:
  • Antimalware Client Version: 4.18.26040.7
  • Engine Version: 1.1.26040.8
1The security intelligence version listed here is relevant to the listed engine release. Newer versions of security intelligence are released regularly. For more information, see Security intelligence updates for Microsoft Defender Antivirus and other Microsoft anti-malware.

Enhancements and features​

  • Performance improvement for SFC cache build during engine reload.
  • Reduced API calls for Device Control to prevent Entra throttling and improved logging.
  • Improved TVM Block logic handling.
  • Fixed TVM Warn temporary paths exclusion issue when Tamper Protection Exclusions and Disable Local Admin Merge (DLAM) are enabled.
  • Fixed Defender managed type when migrating from Co-management to Intune.
  • Fixed three CVEs:
    • CVE-2026-41091: Microsoft Defender Elevation of Privilege Vulnerability — Improper link resolution before file access (Important; fixed in Engine 1.1.26040.8).
    • CVE-2026-45498: Microsoft Defender Denial of Service Vulnerability (Low; fixed in Platform 4.18.26040.7).
    • CVE-2026-45584: Microsoft Defender Remote Code Execution Vulnerability — Heap-based buffer overflow (Critical; fixed in Engine 1.1.26040.8).
Click to expand...
Beta channel update: Engine Version: 1.1.26050.11
 
  • +Reputation
  • Like
  • Thanks
Reactions: Fel Grossi, Lazarus.exe, Zartarra and 11 others
Stable channel updates:
  • Platform 4.18.26050.15
  • Engine 1.1.26050.11

Enhancements and features​

  • Fixed remote-share file scans missing detections, when files were accessed through a symlink.
  • Fixed mpcmdrun -scan output incorrectly displaying non-ASCII characters in localized paths and threat names.
  • Fixed network protection watchdog timers silently not firing.
Click to expand...
 
  • +Reputation
  • Like
Reactions: simmerskool, Zartarra, Halp2001 and 5 others
Windows Antivirus release channel updates:

Platform v.18.26060.3008
Engine v.1.1.26060.3008

Enhancements and features
  • Resolved an issue where Controlled Folder Access toast notifications continuously appeared for the C: drive because of AMD driver injection into protected processes, so users no longer see a flood of repeated CFA "protected memory" prompts.
  • Improved Endpoint DLP enforcement reliability for Chrome uploads to Google Drive, ensuring policy-based blocking is consistently applied during bulk file transfers.
  • Fixed an issue in Endpoint DLP where Chrome and Firefox uploads could occasionally display the default Just-In-Time (JIT) notification instead of the organization-configured custom message due to a timing-related race condition.
  • Addressed Microsoft Defender Elevation of Privilege vulnerability CVE-2026-50656, improving protection against local privilege escalation scenarios in the Microsoft Malware Protection Engine
Microsoft Defender for Endpoint release notes - Microsoft Defender for Endpoint

Windows Antivirus Beta channel updates:
  • Antimalware Client Version: 4.18.26070.6
  • Engine Version: 1.1.26070.6
 
  • +Reputation
  • Like
Reactions: Dave Russo, Zartarra, simmerskool and 4 others
Release channel updates:
  • Antimalware Client Version: 4.18.26070.9
  • Engine Version: 1.1.26070.7
Microsoft Defender for Endpoint release notes - Microsoft Defender for Endpoint

Enhancements and features​

  • Improved archive scanning performance to scale service memory limits dynamically based on the number of logical cores.
  • Improved cache builds on devices with Lunar Lake CPUs by using TrustedImageIdentifier.
  • Fixed an issue where files that were already excluded were still submitted to the cloud protection service for rescanning, only to return the same result.
  • Fixed HTTPS connection stalls under Network Protection Block mode caused by dropped TCP FIN segments.
Click to expand...

Beta channel update:
  • Engine Version: 1.1.26080.2
 
  • Like
  • +Reputation
Reactions: Zartarra, Virtuoso, lokamoka820 and 3 others
Windows Antivirus August 2026 Updates: Platform 4.18.26080.3 | Engine 1.1.26080.3

Enhancements and features​

  • Added health monitoring for environments where Cisco Umbrella affects Network Protection.
  • Hardened Defender Antivirus against unauthorized network authentication credential exposure.
  • Fixed BitLocker encryption-state detection when encrypted volumes have no drive letter.
  • Fixed platform updates that could remain stuck when the staging folder for the update has been purged.
  • Resolved an issue with increased disk I/O due to cleanup failing when the shared signature root location contained whitespace.
  • Fixed path exclusions for AMSI scans when local memory-scan exceptions are enabled.
  • Fixed an issue with the ASR warn unblock option that didn't prompt users for admin approval.
Click to expand...
Microsoft Defender for Endpoint release notes - Microsoft Defender for Endpoint
 
  • +Reputation
  • Like
Reactions: Khushal, Gandalf_The_Grey, lokamoka820 and 2 others
  • Like
Reactions: Khushal, lokamoka820 and Parkinsond

You may also like...