Microsoft has fixed a Microsoft Defender Antivirus bug that incorrectly warned users their antivirus protection was turned off even when Defender was active and working normally. The issue was resolved in Microsoft Defender Antivirus version 4.18.26080.4, released on September 17, 2026. Microsoft says the problem affected supported Windows client and Windows Server versions running recent Defender updates.
The incorrect notifications could appear when Windows started and then return intermittently during normal use. Users were told that “Microsoft Defender Antivirus is turned off,” despite Windows Security continuing to show Defender as enabled and functioning correctly. Microsoft also noted that the false warnings could persist even when notification settings were disabled.
The issue affected a broad range of systems rather than a single Windows release. Microsoft lists Windows 11 versions 26H1, 25H2, 24H2 and 23H2 among the affected client versions, alongside Windows 10 22H2, Windows 10 21H2 and supported LTSC releases. On the server side, affected platforms included Windows Server 2025, 2022, 2019, 2016, 2012 R2 and 2012.
Microsoft first documented the issue in late August, although users had been reporting similar warnings before then. The problem was confusing because the alert suggested a potentially serious security failure while Defender’s actual protection status remained unchanged. Windows Security could still show a healthy system with no action required even as the misleading notification appeared.
The company did not describe the problem as an actual lapse in malware protection. Microsoft specifically states that Defender continued functioning correctly despite the warning, meaning affected systems were not left unprotected simply because the notification appeared. The issue was therefore primarily a reporting and notification bug rather than a failure of the antivirus engine itself.
Version 4.18.26080.4 contains the correction and is the update Microsoft points affected users toward. Microsoft Defender updates are normally delivered automatically, so many systems should receive the fix without manual intervention. Users still seeing the warning can check that Defender has updated to version 4.18.26080.4 or later before troubleshooting the problem further.
The fix matters because security-status warnings need to be reliable enough for users to distinguish a genuine protection failure from a software bug. Repeated false alerts can create confusion over whether a device is actually exposed, particularly on business systems where Defender is part of the organization’s endpoint security setup. In this case, Microsoft’s release-health documentation confirms that the antivirus itself remained active throughout the issue.
Microsoft Defender Antivirus is built into Windows 10 and Windows 11 and is also present across supported Windows Server releases. Definition and platform updates are distributed separately from many of Windows’ larger cumulative updates, allowing Microsoft to correct Defender-specific issues without waiting for a full operating-system patch cycle.
Microsoft now lists the false “Defender Antivirus is turned off” notifications as resolved. Systems running Microsoft Defender Antivirus version 4.18.26080.4 or newer should no longer encounter the erroneous warnings associated with this particular bug.
