CVE-2026-45498
Known exploited · CISA KEV
CVSS 4 MEDIUM: microsoft Defender Denial of Service Vulnerability EPSS 63% (99th percentile). Microsoft patch: Release Notes.
CISA federal remediation date Jun 3 · date passed
Vulnerabilities · 22h ago
Abdelhamid Naceri, aka Nightmare Eclipse, has now published BigDiskBuster, a public proof of concept that stops Microsoft Defender from completing platform and signature updates. The release shifts the issue from a researcher demo to something other people can copy and adapt.
The trick does not turn Defender off. It waits for an update attempt, then fills the disk so the update cannot finish; once the failure happens, it frees the space and waits for the next try. Defender still looks alive, but its detections stop moving forward, which leaves Windows endpoints running current software with stale protection content.
That matters most in estates that treat the service being on as proof of coverage. Reporting also ties the new tool to an earlier Defender flaw Microsoft patched as CVE-2026-45498, but this public PoC is a separate technique and the sources do not say whether Microsoft has a fix for it yet.
Known exploited · CISA KEV
CVSS 4 MEDIUM: microsoft Defender Denial of Service Vulnerability EPSS 63% (99th percentile). Microsoft patch: Release Notes.
CISA federal remediation date Jun 3 · date passed
4 sources covering this story
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
BigDiskBuster can block Microsoft Defender updates by filling disk space, leaving detection content stale; no patch or advisory exists.
NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past
BigDiskBuster leaves Microsoft's antivirus running but unable to install updates
Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity
Abdelhamid Naceri, a former Microsoft Germany employee, is the exploit leaker Nightmare Eclipse, aka Chaotic Eclipse.
New Windows Defender zero-day blocks Microsoft antivirus updates
Over the weekend, security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) released another Microsoft Defender zero-day exploit that blocks antivirus updates.
Part of the PlainSec briefing for 2026-09-23