Microsoft Defender Antivirus Updates for IT Teams: KB2267602, KB4052623 and How to Control Them

Updated: November 2026. Versions checked against Microsoft Learn, the Microsoft Update Catalog and Microsoft's security intelligence page on 11 November 2026.

Open Windows Update history on any PC and the same Defender entry shows up again and again, each time with a new version number. That's by design: Defender runs its own update tracks on its own clock, apart from Patch Tuesday. This guide explains the Microsoft Defender Antivirus update KB2267602, its platform sibling KB4052623 and the older KB915597, then shows how IT teams check versions, stage the rollout and roll back.

TL;DR

• KB2267602. The security intelligence update keeps one KB number and ships a new version multiple times a day.
• KB4052623. The monthly platform update arrives in phases, and builds older than N-2 lose support.
• Defender CVEs. In 2026, Defender's own flaws were fixed in engine and platform builds, not the Windows cumulative update.
• Proof. Get-MpComputerStatus shows each device's versions for comparison with Microsoft's release notes.
• Control. Update channels stage the monthly builds, and MpCmdRun rolls back security intelligence, engine and platform.

What Is the KB2267602 Update

KB2267602 is the security intelligence update for Microsoft Defender Antivirus. Security intelligence is the set of threat definitions Defender checks files against, the thing older guides call signatures. Microsoft keeps one KB number for the track and raises the version with every release. Learn says those releases land multiple times a day, so the same KB fills your update history. Groundhog Day, minus Bill Murray.

The engine, the code that does the scanning, rides inside the same package and changes monthly. Cloud-delivered protection adds dynamic security intelligence between releases, and Microsoft says it doesn't replace the regular updates. System Center Endpoint Protection gets the same kind of package under KB2461484.

KB2267602 isn't a Patch Tuesday update, and the Windows cumulative update doesn't carry it. On one PC, Windows Security > Virus & threat protection > Virus & threat protection updates shows the installed security intelligence version and its download date. Our guide to the Protection updates page covers the rest of that screen.

Microsoft Defender Update Types at a Glance

Defender ships updates on five tracks, each with its own cadence and route. Four have their own KB, and the engine rides inside KB2267602. The versions are what Microsoft's security intelligence page, Learn's release notes and the Update Catalog listed on 11 November 2026, so read them as a format guide.

KB4052623 Platform Updates

KB4052623 updates Defender itself: the service, the program files and the features. Microsoft releases it in phases, so WSUS can list more than one KB4052623 package at once. If Endpoint DLP or Device Control is monitoring processes, the update can be postponed until after a reboot.

Support follows the build. Once a new platform or engine ships, the N-2 build drops to technical upgrade support only, and anything older is unsupported. Features gate on it too: Defender for Endpoint's local AI agent discovery, generally available in October 2026, needs platform 4.18.26090.9 or later on Windows.

Since February 2026, Learn keeps one consolidated release notes page for every Defender platform. Read the release date, not the label: the platform labelled September 2026, 4.18.26090.9, shipped on 12 October.

In early November, an r/DefenderATP admin reported scheduled scans taking more than twice as long after the October build, 4.18.26100.4. One reply measured full scans 35-45% longer, while another called the comparison meaningless without scan details.

Treat it as a field report until Microsoft confirms it, and as the reason monthly builds go to a pilot ring first.

What KB915597 Means in Update History

KB915597 is the older Windows Defender definitions KB. Microsoft's support article for that number describes definition and periodic engine updates delivered through Windows Update, Automatic Updates and WSUS. A Microsoft Q&A thread from July 2023 shows a security intelligence update listed under KB915597, numbered in the KB2267602 series of the time.

Current Learn docs list only KB2267602 for Defender Antivirus, and a Catalog search for KB915597 returned nothing on 11 November 2026. When it shows up in history, read it as a Defender security intelligence update under an older KB number, not a separate patch.

Microsoft Security Updates for Defender Antivirus Itself

Defender has its own bugs, and Microsoft fixes them inside Defender. These are Microsoft security updates for Microsoft Defender Antivirus itself, and the fixes ship as engine or platform builds. Eleven 2026 CVEs show the pattern, and three reached CISA's Known Exploited Vulnerabilities catalog.

KEV status comes from the catalog CISA released on 10 November 2026. Four of the seven MSRC dates fell on a Patch Tuesday: 14 April, 14 July, 13 October and 10 November. The 19 May, 16 June and 14 August dates didn't. Even on Patch Tuesday, the fix was a Defender build released on or before the MSRC date. Engine 1.1.26100.4, which fixes CVE-2026-122194, came out on 27 October, two weeks before MSRC listed the CVE.

So a report built on cumulative updates shows none of these fixes, and a version check shows all of them. Our November roundup lists this month's Defender versions, and the timeline below sets the April to June fixes against the Windows calendar.

KEV entries go to the front of the queue, and our roundup of vulnerability tools shows how scanners pull CISA KEV data into priorities.

AV-Comparatives used these May listings in its case for engine diversity, which our comparison of Defender against paid suites covers.

How to Check Defender Versions

Proof that a device is current takes two numbers: what it runs and what Microsoft last shipped. The Windows Security update page shows only security intelligence, so script the rest in PowerShell.

powershell
Get-MpComputerStatus |
  Select-Object AMProductVersion, AMEngineVersion, AMRunningMode,
    AntivirusSignatureVersion, AntivirusSignatureLastUpdated, AntivirusSignatureAge

AMEngineVersion is the engine, and AntivirusSignatureVersion is security intelligence. AntivirusSignatureAge counts days since the last update, and 65535 means never. Microsoft's class reference describes AMProductVersion only as the product version. Check on a test device which release notes column it matches before you report on it.

Then compare each number with the release notes, because a build older than N-2 is unsupported. AMRunningMode shows which mode Defender runs in, and our guide to Defender passive mode explains the difference.

OpenFrame is open, AI-native infrastructure for IT and security. It can run that status check as a script across every device and collect the versions in one place. It costs $1 per device per month, with a 14-day free trial. Flamingo builds OpenFrame, which runs alongside Defender rather than replacing it.

How to Update Defender Manually

For one machine, or a fleet that's fallen behind, Microsoft documents these routes:

1. In Windows Security, open Virus & threat protection updates and select Check for updates.
2. In PowerShell, run Update-MpSignature. It walks the configured fallback order, and -UpdateSource MicrosoftUpdateServer forces one source.
3. If updates stall, go to %ProgramFiles%\Windows Defender, run MpCmdRun.exe -removedefinitions -dynamicsignatures, then MpCmdRun.exe -SignatureUpdate.
4. Offline, download mpam-fe.exe from the security intelligence page and run it on the device.
5. For the platform, download KB4052623 from the Microsoft Update Catalog. Learn says manual or third-party platform deployments install 4.18.2001.10 first.

KB2267602 has no Catalog download we could find: a search returned no results on 11 November 2026. Offline machines take mpam-fe.exe or a file share instead.

For new builds, Microsoft publishes Defender update packages for Windows 10, Windows 11 and Windows Server 2012 R2 and later installation images, in WIM and VHD formats. Apply them with DISM so a fresh install doesn't start on an old build.

How Defender Updates Reach a Fleet

Microsoft's update sources page lists five places a device can pull Defender updates from. Microsoft Update ships smaller releases more often. WSUS, Configuration Manager and the security intelligence page deliver less often, with larger deltas.

Intune sets the fallback order and channels through policy, but it isn't one of the five sources. Microsoft suggests an automatic approval rule in WSUS, since updates arrive at least once a day. Our guide to WSUS deprecation covers where WSUS is headed.

The order lives in one setting with four values: InternalDefinitionUpdateServer, MicrosoftUpdateServer, MMPC and FileShares. Set it with Group Policy, Set-MpPreference -SignatureFallbackOrder or the Defender CSP, then write it into your patch policy template.

Why Pausing Windows Update Stalls Defender

Microsoft's update sources page says security intelligence and platform updates are delivered through Windows Update. Pause it on a device that pulls from Microsoft Update, and Defender stops updating too, unless another source sits in the fallback order. Our guide to pausing Windows Update shows how to avoid that.

Stage Defender Updates With Update Channels

Channels decide how early a device gets each monthly platform and engine build. Microsoft's gradual rollout page describes five. The last column is our own sample three-ring setup, not a Microsoft recommendation.

Security intelligence has two channels, Staged and Broad. The Defender CSP currently documents Staged as equivalent to Broad for security intelligence, so validate any timing difference yourself. Leave a channel unset and Microsoft picks one, possibly early in the cycle.

Microsoft's own Intune ring example uses two rings. The pilot takes engine and platform on Beta and security intelligence on Staged. Production takes engine and platform on Critical: Time Delay and security intelligence on Broad, which Microsoft says gives a three-hour window to catch a false positive. Its emergency stop sets the fallback order to FileShares with no share listed, until you restore the recorded value.

In Intune, the settings catalog's Defender category holds Platform Updates Channel, Engine Updates Channel, Security Intelligence Updates Channel and Disable Gradual Release. Pick Intune or Group Policy, not both, because Microsoft says MDMWinsOverGP doesn't apply to the Defender CSP. In PowerShell, on platform 4.18.2106.6 or later:

powershell
Set-MpPreference -PlatformUpdatesChannel Preview
Set-MpPreference -EngineUpdatesChannel Preview
Set-MpPreference -DefinitionUpdatesChannel Staged

For devices on Windows Update, Microsoft's default advice is to take monthly Defender updates as they arrive. Stage when one bad build would cost more than a short delay.

Robert Crane of CIAOPS walks through staging Defender for Endpoint updates with Intune in this July 2024 video. It predates the CSP note on Staged and Broad, so match the setting names against the current settings catalog.

How to Roll Back a Defender Update

MpCmdRun.exe rolls back security intelligence, the engine and the platform separately, from an elevated prompt. Learn runs it from the newest folder under %ProgramData%\Microsoft\Windows Defender\Platform, falling back to %ProgramFiles%\Windows Defender.

Microsoft's gradual rollout page adds a 2026 change. On platform 4.18.26030.3011 or later, EDR updates can also roll back to the inbox version or N-1, if a backup exists. If a platform build slows your machines, -RevertPlatform takes a test device back one build while you measure.

A rolled-back device runs an older build, so log it and move it forward once the fix ships. These commands cover Defender only, and our Windows update rollback guide handles the operating system.

When Defender Updates Fail

Microsoft's troubleshooting page sets the order. Check the network, confirm Defender is the primary antivirus, try the manual package, then run MpCmdRun -SignatureUpdate -MMPC. If that works, suspect WSUS approvals, a stale file share or Windows Update.

When the errors come from Windows itself, our guide to Windows Update errors covers the repairs.

Sometimes the update installs cleanly and the new build is the problem. On 3 May 2026, r/sysadmin admins woke to Defender quarantining DigiCert root certificates as malware. They tied it to one security intelligence build and shared queries to check whether the deleted registry keys came back.

That Sunday morning is the case for a pilot ring, and for keeping the rollback commands within reach.

Keep Defender Current on Its Own Clock

KB2267602 is security intelligence and repeats by design, KB4052623 is the monthly platform, and KB915597 is an older KB number for Defender definitions. Defender's own 2026 CVEs were fixed in engine and platform builds, so a cumulative update report can't prove a device is safe. Check versions with Get-MpComputerStatus, stage monthly builds with channels and keep MpCmdRun ready for a bad one. For the Windows side of the calendar, read our Patch Tuesday schedule next.