Microsoft Defender for Endpoint Update Leaves Linux Servers Vulnerable

A recent update to Microsoft Defender for Endpoint on Linux has caused significant issues, disabling the antivirus protection on affected devices after reboot. Specifically, builds 101.26042.0000 through 101.26042.0009 are impacted, leaving Linux servers exposed to threats. The problem primarily affects systems running Red Hat Enterprise Linux (RHEL) 8 and 9 in FIPS mode, where installation of the update may fail entirely. Microsoft has paused the rollout of the problematic update and is working on a revised build expected to be released by late July 2026. Users are advised to avoid upgrading to the affected build until further notice. The issues could lead to a lapse in active protection, raising concerns among system administrators. Microsoft has provided guidance for remediation, directing users to specific builds that address the vulnerabilities.

Key Points: • Microsoft Defender for Endpoint on Linux disabled protection after reboot for certain builds. • The issue affects RHEL 8 and 9 systems, particularly those in FIPS mode. • Microsoft has paused the rollout and is working on a revised build expected by late July 2026.