Microsoft Defender Scans Fail Following August 2026 Security Updates
On August 18, 2026, Microsoft Defender began aborting Quick, Full, and Offline virus scans across Windows PCs after a series of Security Intelligence updates were deployed. The issue left home users and enterprise administrators without reliable malware detection, as scans either failed to complete or triggered repeated service restarts.
Reports from Neowin, CyberInsider, Reddit, and Microsoft’s Q&A forums described a consistent pattern: scans would initiate but terminate prematurely, with Windows Security displaying a "threat service has stopped" error. Offline scans stalled at 90–93%, while the Microsoft Safety Scanner a fallback tool exhibited the same behavior. Manual drive scans, however, reportedly completed successfully, suggesting the fault lay in Defender’s scheduled scan mechanism rather than file inspection itself.
Event logs revealed that the antimalware process MsMpEng.exe crashed within mpengine.dll, generating an access violation error (0xC0000005). The issue was traced to Microsoft Malware Protection Engine versions 1.1.26070.7 and 1.1.26080.2, paired with Security Intelligence Updates 1.457.222.0–1.457.235.0. The crashes occurred on both clean Windows installations and managed endpoints, leading administrators to clarify that a failed scan did not necessarily indicate infection.
Speculation arose linking the outage to ShieldBreak, a zero-day local privilege-escalation exploit against Defender published shortly after Microsoft’s August 2026 Patch Tuesday. The proof-of-concept, developed by researcher Nightmare Eclipse, bypassed an earlier vulnerability (CVE-2026-50656) and was independently verified to elevate low-privileged users to SYSTEM privileges. While some Reddit users suggested the scan failures stemmed from rushed mitigations for ShieldBreak, Microsoft has not confirmed a direct connection.
Microsoft acknowledged investigating the issue but had not released an official incident bulletin at the time of reporting. Community testing identified that updating to Security Intelligence Update 1.457.236.0 (or later, including 1.457.238.0) restored scan functionality for many affected systems. Users unable to update were advised to use a secondary antivirus tool for malware checks, treating any suspicious files as separate investigations rather than assuming the crash resolved potential threats.
Source: https://cybersecuritynews.com/windows-defender-0-day-update-crash/
Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-security
"id": "mic1787149631",
"linkid": "microsoft-security",
"type": "Vulnerability",
"date": "8/2026",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"{'affected_entities': [{'customers_affected': 'Home users and enterprise '
'administrators using Microsoft '
'Defender',
'industry': 'Software/Security',
'location': 'Global',
'name': 'Microsoft',
'size': 'Large Enterprise',
'type': 'Technology Company'}],
'customer_advisories': 'Home users advised to update Defender or use '
'alternative malware detection tools',
'date_detected': '2026-08-18',
'date_publicly_disclosed': '2026-08-18',
'description': 'On August 18, 2026, Microsoft Defender began aborting Quick, '
'Full, and Offline virus scans across Windows PCs after a '
'series of Security Intelligence updates were deployed. The '
'issue left home users and enterprise administrators without '
'reliable malware detection, as scans either failed to '
'complete or triggered repeated service restarts. Reports '
"described scans terminating prematurely with a 'threat "
"service has stopped' error, while offline scans stalled at "
'90–93%. Manual drive scans completed successfully, suggesting '
'the fault lay in Defender’s scheduled scan mechanism. The '
'issue was traced to Microsoft Malware Protection Engine '
'versions 1.1.26070.7 and 1.1.26080.2, paired with Security '
'Intelligence Updates 1.457.222.0–1.457.235.0, causing crashes '
'in MsMpEng.exe within mpengine.dll.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'unreliable security software',
'downtime': 'Malware detection scans failed to complete',
'operational_impact': 'Loss of reliable malware detection, '
'repeated service restarts',
'systems_affected': 'Windows PCs with Microsoft Defender (home and '
'enterprise)'},
'investigation_status': 'Ongoing (Microsoft investigating)',
'lessons_learned': 'Potential risks of rushed security updates and the '
'importance of fallback malware detection tools',
'post_incident_analysis': {'corrective_actions': 'Update to Security '
'Intelligence Update '
'1.457.236.0 or later',
'root_causes': 'Crash in MsMpEng.exe '
'(mpengine.dll) due to Security '
'Intelligence Updates '
'1.457.222.0–1.457.235.0; potential '
'link to rushed mitigations for '
'ShieldBreak exploit'},
'recommendations': 'Update to the latest Security Intelligence Update, use '
'secondary antivirus tools if scans fail, and monitor '
'official Microsoft communications for patches',
'references': [{'source': 'Neowin'},
{'source': 'CyberInsider'},
{'source': 'Reddit'},
{'source': 'Microsoft Q&A Forums'}],
'response': {'communication_strategy': 'Community forums and unofficial '
'advisories; no official Microsoft '
'bulletin at time of reporting',
'containment_measures': 'Community testing identified that '
'updating to Security Intelligence '
'Update 1.457.236.0 (or later) restored '
'scan functionality',
'incident_response_plan_activated': 'Investigation acknowledged '
'by Microsoft',
'recovery_measures': 'Use secondary antivirus tools for malware '
'checks if unable to update',
'remediation_measures': 'Update to Security Intelligence Update '
'1.457.236.0 or later'},
'stakeholder_advisories': 'Enterprise administrators advised to update or use '
'secondary tools',
'title': 'Microsoft Defender Scans Fail Following August 2026 Security '
'Updates',
'type': 'Software Failure',
'vulnerability_exploited': 'Potential link to ShieldBreak (CVE-2026-50656 '
'bypass)'}