# Microsoft Defender for Endpoint leaves Linux systems vulnerable Security update causes protection failures on some Linux devices - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-07-27 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/2f882a02-b907-4084-9e7f-03bc5757f064 ## Critical flaw in Microsoft Defender Microsoft disclosed two critical issues in Defender for Endpoint's Linux version. The first problem affects all versions between 101.26042.0000 and 101.26042.0009, causing the security service to disable after reboot. Systems using Defender for Servers (Plan 1 or 2) with Defender for Cloud integration might automatically install affected versions. While Microsoft didn't explain the root cause, endpoint protection failing poses significant risks for system administrators, potentially leaving systems exposed to threats. ## FIPS-enabled RHEL systems impacted The second issue affects Red Hat Enterprise Linux 8 and 9 systems running in FIPS mode. The 101.26042.x update fails to install on these systems, leaving devices running outdated versions. FIPS (Federal Information Processing Standards) specifies cryptography requirements for government and regulated systems. Microsoft confirmed the FIPS issue is fixed in version 101.26052.0011 and later. However, affected systems temporarily remain without critical security updates, creating potential vulnerabilities. ## Automatic update risks Systems with Microsoft Defender for Cloud and MDE integration enabled have automatic updates turned on by default for the MDE.Linux extension. This means affected versions could be installed automatically, with protection failing after reboot. Microsoft warns that impacted devices lose active protection until remediation steps are applied. System administrators must monitor their update channels closely and consider temporarily disabling automatic updates for critical systems until the issue is fully resolved. ## Microsoft's update track record While Microsoft has a history of problematic Windows updates, this incident is particularly severe. Having security software itself broken by an update creates substantial risks, especially during increasing cyber threats. The promise of unified visibility through Microsoft Defender portal becomes less compelling when the core protection mechanism fails. This event raises questions about the reliability of endpoint protection solutions that organizations heavily depend on for their cybersecurity posture. ## Solutions for affected systems Microsoft states the service-disabling issue is fixed in build 101.26042.0011, while the FIPS installation problem is resolved in version 101.26052.0011 and later. System administrators need to manually verify and apply these updates. Experts recommend performing backups and testing updates in staging environments before production deployment, especially for critical systems. The incident highlights the need for more rigorous quality control in Microsoft's update processes for security products. ## Unified management pros and cons Defender for Endpoint on Linux protects on-premises and cloud server workloads, offering unified visibility through Microsoft Defender portal. This integration appears attractive for organizations fully committed to Microsoft's ecosystem. However, single-point management advantages come with single-point-of-failure risks. This incident underscores the importance of diversity in security solutions, prompting some organizations to reconsider multi-vendor strategies for critical protection layers. ## Industry alternatives The market offers other endpoint security platforms like CrowdStrike Falcon and SentinelOne. However, Defender's deep integration in complex Microsoft environments often gives it an edge. Following this incident, some enterprises might implement multi-layered security approaches. Security experts emphasize the value of defense-in-depth strategies, particularly for organizations handling sensitive data or operating critical infrastructure that requires continuous protection. ## Update management importance in cybersecurity This incident demonstrates that security solutions themselves can contain vulnerabilities, sparking renewed debate about automatic update mechanisms. Organizations should strengthen pre-update testing procedures and implement manual approval processes for critical systems. Microsoft needs to review its update quality control processes, as such flaws weaken organizational defenses against growing cyber threats. The event serves as a reminder that even security tools require careful update management to maintain protection effectiveness. ## Sources covering this story - https://www.theregister.com/patches/2026/07/27/microsoft-defender-for-endpoint-leaves-some-linux-boxes-defenseless-after-update/5278914 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._