Back mc.merill.net

Microsoft's alert

mc.merill.net • July 28, 2026

Do not upgrade to Microsoft Defender for Endpoint on Linux build 101.26052.0009 due to issues on FIPS-enabled RHEL 8 and 9 devices. Rollout is paused; a revised build will be released by late July 2026. Those without issues after upgrading need no immediate action.

View in Message Center

We have paused the rollout and are actively working on a revised build. We will provide an update through the Message Center and release notes when the updated package becomes available.

Worldwide, GCC, GCC High, DoD): We will begin rolling out on mid-July 2026 and expect to complete by late July 2026.

Impact on your organization:

On affected devices, installation or upgrade of the platform package may fail, preventing successful completion of the update process.

Action Required/Recommendations:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Defender for Endpoint Update Leaves Linux Servers Vulnerable A recent update to Microsoft Defender for Endpoint on Linux has caused significant issues, disabling the antivirus protection on affected devices after reboot. Specifically, builds 101.26042.0000 through 101.26042.0009 are impacted, leaving Linux servers exposed to threats. The problem primarily affects systems running Red Hat Enterprise Linux (RHEL) 8 and 9 in FIPS mode, where installation of the update may fail entirely. Microsoft has paused the rollout of the problematic update and is working on a revised build expected to be released by late July 2026. Users are advised to avoid upgrading to the affected build until further notice. The issues could lead to a lapse in active protection, raising concerns among system administrators. Microsoft has provided guidance for remediation, directing users to specific builds that address the vulnerabilities. 5 sources 55

Extracted Entities

Platforms (2)

Linux RHEL