Defender 4.18.26080.4 ends the false Antivirus is turned off alerts (September 18, 2026)

What changed since August 30

I covered these notifications in the August 30 post, when Microsoft had confirmed them and had no fix. The release health entry, opened at 15:34 PT on August 28, 2026, now reads Resolved as of 18:22 PT on September 17, 2026. Its resolution line names the Microsoft Defender Antivirus update, version 4.18.26080.4, released on September 17, 2026.

The problem itself has not been redefined. After the latest Defender updates, notifications said "Microsoft Defender Antivirus is turned off" even though the antivirus was working and all settings showed it as active. They appeared at startup and intermittently afterward, and they persisted even with notification settings turned off. Microsoft lists Windows 11 26H1, 25H2, 24H2 and 23H2, Windows 10 22H2 and 21H2 plus two Enterprise LTSC releases, and Windows Server 2012 through Windows Server 2025.

BleepingComputer's September 18 report adds the history. Microsoft acknowledged the bug in late August, although Release Preview Channel users of the Windows Insider program had seen it since at least June. The alert asked people to "Tap or click to turn on Microsoft Defender Antivirus."

Why a status bug blocked some people from work

Rudy Ooms's analysis on the Patch My PC blog, first posted September 12, 2026 and updated September 18, 2026, explains why this was more than an annoying pop-up on managed PCs. Intune's Antivirus compliance check relies on Windows Security Center to report whether the antivirus is on. When Security Center held the wrong state, Intune could mark a healthy device noncompliant. With a Conditional Access policy that requires a compliant device, the user could then be blocked from company resources while Defender was still protecting the machine.

His testing traces the fault to a startup race. Security Center could ask for Defender's state before Defender had finished starting, and keep that empty or stale answer. In his tests, version 4.18.26080.4 changes that exchange. Defender waits up to 50 seconds to finish starting, reports a temporary on state only if it is still not ready, then replaces it with the real state and retries if the update to Security Center fails. Patch My PC says plainly that this description comes from its own testing and the platform changes it observed, not from Microsoft documentation.

How the fix reaches a PC

Microsoft's Defender update documentation, last updated August 25, 2026, says platform updates are released monthly under KB4052623. It lists Windows Update, WSUS, Configuration Manager and the Windows Security app among the ways to get them. Patch My PC notes that monthly releases go to the Beta channel first, then Preview, then a staged rollout, with the Broad channel last. It says Microsoft support quoted September 17 for Broad availability, which matches the release date on the release health entry.

An unmanaged PC picks the platform up through Windows Update like any other Defender update. A managed PC gets it when its WSUS or Configuration Manager approvals allow. Until 4.18.26080.4 is installed, the false alert can still appear, so a fresh one on an older platform is not a sign that the fix failed.

The Excel 2016 paste fix, and who it leaves out

Yesterday's post on KB5002914 named KB5002665, the Excel 2016 fix Microsoft dates September 16, 2026, and could say little more about it. Two things arrived today: Microsoft's own confirmation to BleepingComputer in a report published September 18, 2026, and the Download Center listing, published the same day with full-file packages of 131.6 MB for x86 and 136.7 MB for x64.

The fix has limits Microsoft states on its own KB5002665 support page, which describes the update as a fix for the known issue in KB5002914 that causes certain paste operations to fail silently. It applies to the MSI edition of Office 2016 and not to Click-to-Run editions. If a workbook contains conditional formatting, paste can still fail, and Microsoft's workaround is Paste Special with Formulas, Formulas & Number Formatting, Values, Values & Number Formatting or Link. Microsoft told BleepingComputer: "We released update KB5002665 to mitigate this issue. We are aware of some user scenarios impacted by conditional formatting and recommend customers follow our guidance."

The same report says the bug also affects Excel Online, 2024, 2021 and 2019, and none of those has a Microsoft-confirmed fix. BleepingComputer says users told it that updates released on September 12 for Office 2019, 2021 and 2024 resolve the problem, and that Microsoft has not confirmed it.

What you can do today

1. Check your Defender platform version. In PowerShell, run Get-MpComputerStatus | Select-Object AMProductVersion, AMServiceVersion, the check Patch My PC uses. A result of 4.18.26080.4 or later means the fix is installed.

2. If the version is older, use Windows Update or the Windows Security app. Microsoft lists both as ways to get platform updates.

3. Before you dismiss any antivirus warning, open Windows Security and look at the settings. This bug showed Defender as active in its settings while the notification said it was off. A warning that matches the settings is a real problem and deserves attention.

4. If you run Intune, recheck devices that failed the Antivirus compliance check since late August once they report 4.18.26080.4. If you relaxed or unassigned that check as a stopgap, restore it after the devices update. Patch My PC also suggests keeping the Antivirus requirement in its own compliance policy, and calls that a design recommendation, not a Microsoft rule.

5. On the MSI edition of Excel 2016, install KB5002665 from the Download Center, and keep Paste Special for workbooks with conditional formatting.

6. On Excel 2019, 2021 or 2024, install the current Office updates and keep using Paste Special until Microsoft confirms a fix for your version.

Get XLAnt