Full Report
Microsoft asked customers this week to ignore incorrect alerts that Defender Antivirus has been turned off after installing the latest Defender updates. [...]
Analysis Summary
# Vulnerability: Microsoft Defender Antivirus Erroneous "Turned Off" Notifications
## CVE Details
- **CVE ID**: N/A (Functional Bug / False Positive Alert)
- **CVSS Score**: N/A
- **CWE**: CWE-696: Incorrect Behavior Order (Functional Logic Error)
## Affected Systems
- **Products**: Microsoft Windows Client and Server
- **Versions**: All supported versions, specifically:
- Windows 11 (including 26H1)
- Windows Server 2025
- **Configurations**: Systems that have installed the latest Microsoft Defender Antivirus updates (notably affecting users in the Windows Insider Release Preview Channel since June 2026).
## Vulnerability Description
This is not a security vulnerability in the sense of a flaw that can be exploited for unauthorized access; rather, it is a **functional reporting bug**. After installing the latest Defender updates, the Windows Security app intermittently triggers notifications stating, "Microsoft Defender Antivirus is turned off," and prompts users to click to reactivate it. Technical investigation by Microsoft confirms the antivirus engine is actually functioning correctly and all settings are active; the issue lies solely in the notification subsystem failing to recognize the active state of the service.
## Exploitation
- **Status**: Not exploited (Not an exploitable security flaw)
- **Complexity**: N/A
- **Attack Vector**: N/A
## Impact
- **Confidentiality**: None
- **Integrity**: None
- **Availability**: Low (Impacts "System Integrity" perception; potential for "security fatigue" where users begin to ignore legitimate security alerts due to persistent false positives).
## Remediation
### Patches
- **Status**: A fix is currently in development. Microsoft intends to deliver the resolution via a future Microsoft Defender Antivirus update.
### Workarounds
- **Ignore Alerts**: Microsoft officially advises customers to ignore these specific notifications until a patch is released.
- **Verify Status**: Users can manually verify protection by opening the Windows Security app and checking the "Virus & threat protection" dashboard to confirm that the engine is active despite the pop-up notification.
## Detection
- **Indicators**:
- Notification toast: "Microsoft Defender Antivirus is turned off."
- Windows Security app prompt: "Tap or click to turn on Microsoft Defender Antivirus."
- **Detection methods**: Cross-reference the notification with the actual service status in the Windows Security dashboard or by checking the status of the `WinDefend` service via PowerShell: `Get-Service WinDefend`.
## References
- **Vendor Advisory**: hxxps[://]learn[.]microsoft[.]com/en-au/windows/release-health/status-windows-11-25h2#incorrect-notifications-that--microsoft-defender-antivirus-is-turned-off-
- **News Report**: hxxps[://]www[.]bleepingcomputer[.]com/news/microsoft/microsoft-asks-users-to-ignore-antivirus-is-turned-off-errors/