All apps
D
Microsoft Defender Antivirus
Endpoint SecurityBuilt-in Windows antimalware — antimalware platform (client) version
Latest versions
StableWindows4.18.26090.9
Actively exploited
0
CISA KEV · 2 lifetime
Affecting latest
0
v4.18.26090.9
+26 unverified
Known CVEs
28
across all versions, as matched by PemSync
Last checked
21 Oct 2026, 4:42
Of 28 recorded CVEs, 2 are fixed in versions you're past. 26 could not be evaluated against 4.18.26090.9 — treat them as unknown rather than resolved. They are listed first in the table below.
| CVE | Severity | EPSS pct | Status | Score source | |
|---|---|---|---|---|---|
CVE-2021-1647Exploited | HIGH 7.8 | 99% | Impact unverified | NVD | 12 Jan 2021 |
CVE-2017-8540Exploited | HIGH 7.8 | 99% | Impact unverified | NVD | 26 May 2017 |
| — | 48% | Impact unverified | — | 25 Feb 2021 | |
| — | 54% | Impact unverified | — | 14 Jul 2020 | |
| — | 76% | Impact unverified | — | 9 Jun 2020 | |
| — | 59% | Impact unverified | — | 9 Jun 2020 | |
| — | 53% | Impact unverified | — | 15 Apr 2020 | |
| — | 60% | Impact unverified | — | 15 Apr 2020 | |
| — | 91% | Impact unverified | — | 23 Sep 2019 | |
| — | 61% | Impact unverified | — | 14 Aug 2019 | |
| — | 99% | Impact unverified | — | 4 Apr 2018 | |
| — | 99% | Impact unverified | — | 29 Jun 2017 | |
| — | 93% | Impact unverified | — | 26 May 2017 | |
| — | 99% | Impact unverified | — | 26 May 2017 | |
| — | 93% | Impact unverified | — | 26 May 2017 | |
| — | 99% | Impact unverified | — | 26 May 2017 | |
| — | 97% | Impact unverified | — | 26 May 2017 | |
| — | 97% | Impact unverified | — | 26 May 2017 | |
| — | 97% | Impact unverified | — | 26 May 2017 | |
| — | 100% | Impact unverified | — | 9 May 2017 | |
| — | 78% | Impact unverified | — | 10 Jul 2013 | |
| — | 78% | Impact unverified | — | 9 Apr 2013 | |
| — | 78% | Impact unverified | — | 25 Feb 2011 | |
| — | 96% | Impact unverified | — | 13 May 2008 | |
| — | 96% | Impact unverified | — | 13 May 2008 |
Showing 1–25 of 28
Page 1 of 2
PemSync reports known, cataloged exploited vulnerabilities (CISA KEV) and published CVEs. It is not a zero-day detection or threat-intelligence system — a vulnerability may be exploited before it appears here. Absence of data does not mean an app is secure.