Microsoft Defender for Endpoint leaves some Linux boxes defenseless after update

1. Executive summary

Microsoft has disclosed two defects in Defender for Endpoint (MDE) on Linux arising from the 101.26042.x update train. The more serious issue (affecting versions 101.26042.0000 through 101.26042.0009 across all supported Linux distributions) can silently disable the Defender service after an upgrade or reinstall followed by a reboot, leaving endpoints with no active protection. A second issue prevents the update from installing on RHEL 8 and 9 systems running in FIPS mode, leaving those hosts stranded on their previous version. Organisations using Defender for Servers (Plan 1 or 2) with Defender for Cloud and MDE integration enabled are at elevated risk because affected versions may have been pushed automatically. No verified CVE data, CVSS scores, or CISA-KEV exploitation state have been resolved for this item; the assessment below is based solely on the source article.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 18: classification of ICT-related incidents and cyber threats	A security update disabled active endpoint protection on production Linux hosts after reboot, creating a period of unmonitored and undefended state across the estate.	The event must be classified as an ICT-related incident under the entity's DORA taxonomy; the scope (number of rebooted hosts running affected versions) determines whether it escalates to a major incident under Art. 19.
DORA Art. 17: ICT-related incident management process	The defect was introduced through an automatic update channel (Defender for Cloud MDE.Linux extension auto-update), meaning the incident was vendor-triggered and required detection, containment, and remediation steps outside normal change control.	Clients must invoke their incident management process to identify affected hosts, apply remediation, and verify restoration of active protection — not merely treat this as a patch-management task.

3. Technical analysis & attack chain

This is a product-defect event, not a threat-actor-driven attack. No CVE, CVSS, or CISA-KEV data has been resolved for this item. The following is reconstructed from the single source article (The Register, 2026-07-27); all technical claims are single-sourced and should be verified against Microsoft's own release notes before enforcement.

Issue 1 — Defender service disabled after reboot (higher severity)

MDE for Linux versions 101.26042.0000 through 101.26042.0009 are installed (manually or automatically) on a supported Linux host.
Where Defender for Servers (Plan 1 or 2) is used with Defender for Cloud and MDE integration enabled, the MDE.Linux extension auto-updates by default — meaning affected versions may have been deployed without administrator action.
After an upgrade or reinstall of the affected version, the host is rebooted.
On reboot, the Defender service may be disabled on some devices. Microsoft did not specify the root cause of the service failure.
The endpoint is left without active protection until manual remediation is performed.

Affected versions (Issue 1): 101.26042.0000 – 101.26042.0009 Affected platforms: All supported Linux operating systems Fix version (Issue 1): Build 101.26042.0011 (per Microsoft release notes; the alert itself did not mention an available update)

Issue 2 — Update fails on FIPS-enabled RHEL 8/9 (lower severity)

A RHEL 8 or RHEL 9 system is operating in FIPS mode (US Federal Information Processing Standards cryptographic requirements enforced).
The 101.26042.x update is attempted.
Installation fails; the device remains on its previous (pre-26042) version.
The host retains its existing protection level but does not receive the update's fixes or improvements.

Affected platforms (Issue 2): RHEL 8 and RHEL 9 in FIPS mode Fix version (Issue 2): 101.26052.0011 and later

Confidence caveat: All version numbers, affected platforms, and fix builds are drawn from a single source (The Register article citing Microsoft). The root cause of the service-disabling bug was not disclosed. Verify against Microsoft's official release notes and support documentation before acting at scale.

4. Mitigation & containment

P1 — Within 24 hours: Identify and triage affected hosts

Inventory all Linux hosts running MDE and determine the installed version. On each host: bash mdatp health | grep -i version
Cross-reference against the affected range (101.26042.0000 – 101.26042.0009).
Identify hosts enrolled in Defender for Servers Plan 1/2 with Defender for Cloud MDE integration, as these may have received the affected version via auto-update.
For any host found running an affected version that has been rebooted, verify whether the Defender service is active: bash systemctl status mdatp
If the service is inactive or failed, attempt restart: bash sudo systemctl restart mdatp
If the service does not restart, proceed to P2 remediation.

P2 — Within 72 hours: Remediate

Issue 1 (service disabled): Update affected hosts to build 101.26042.0011 or later. If the update cannot be applied immediately, consider temporarily disabling the MDE.Linux extension auto-update in Defender for Cloud to prevent further propagation of affected versions while remediation is staged.
Issue 2 (FIPS installation failure): Update FIPS-enabled RHEL 8/9 hosts to version 101.26052.0011 or later. If the update still fails, engage Microsoft support; do not disable FIPS mode as a workaround on regulated systems.
After remediation, reboot a sample host and confirm the service survives restart: bash sudo reboot # post-reboot: systemctl status mdatp mdatp health

P3 — Within 7 days: Verify and harden

Audit all Linux endpoints to confirm no host remains on an affected version.
Review Defender for Cloud auto-update settings for the MDE.Linux extension; document the current state and decide whether auto-update should remain enabled given this incident.
If any hosts ran without active protection for a measurable period, assess whether the gap constitutes a reportable ICT-related incident under DORA Art. 18/19 classification criteria and the entity's internal thresholds.

5. Indicators of compromise

No indicators of compromise available in the source material. This is a product-defect event, not a threat-actor intrusion. No malicious domains, IPs, hashes, file paths, or command-line artefacts are described.

Behavioural indicators

Behaviour	Where to observe	Confidence
MDE service (`mdatp`) found inactive or failed after reboot on hosts running versions 101.26042.0000–101.26042.0009	`systemctl status mdatp`; Defender portal device health	High (single-sourced)
MDE.Linux extension update to 101.26042.x fails on RHEL 8/9 in FIPS mode	Extension deployment logs in Defender for Cloud; `yum`/`dnf` package logs	High (single-sourced)

6. Detection

Insufficient indicators to author detection rules. The source material describes a product-defect condition (service state and package version) rather than threat artefacts such as distinctive strings, file paths, or command-line patterns attributable to a malicious actor. Detection should be operationalised through endpoint health monitoring (service status checks and version inventory) rather than YARA or Sigma rules.

7. Sources

The Register, "Microsoft Defender for Endpoint leaves some Linux boxes defenseless after update," https://www.theregister.com/patches/2026/07/27/microsoft-defender-for-endpoint-leaves-some-linux-boxes-defenseless-after-update/5278914, 2026-07-27

8. Adverse Trace position

This is a high-impact availability defect in a critical security control, not a vulnerability being exploited by threat actors — no CISA-KEV exploitation state has been confirmed. The risk to EMEA financial services is material: any host that received an affected version via auto-update and was subsequently rebooted may have been operating without endpoint protection, creating a blind spot during a period of active threat activity. Clients should prioritise version inventory and service-status verification across their Linux estate within 24 hours. We will monitor for any Microsoft advisory, CVE assignment, or evidence of in-the-wild exploitation and update this note if the risk profile changes. All technical detail in this advisory is single-sourced (The Register); verify against Microsoft's official release notes before large-scale remediation.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.