SecOps SignalSecurity Intelligence Workspace
Collection Degraded30 / 46 Sources HealthyPublic Intel Only
Source: Microsoft Defender for Endpoint releases · Limited verificationCanonical source
RECENTProduct updateAction required

Linux | March 2026 | 101.26012.0007

Analysis / inference: Microsoft Defender for Endpoint for Linux version 101.26012.0007 enhances vulnerability detection for Python workloads while addressing severe known issues involving service disabler bugs and FIPS installation failures.

Dates
Source and collection dates not recorded
Source
Microsoft Defender for Endpoint releases · Limited verification
Classification
Microsoft Security

Section 01 · Summary analysis

Python workload vulnerability coverage was expanded for CVE-2025-68664 and CVE-2025-6865, real-time protection statistics collection was changed to disabled by default, and fixes were provided for an upgrade service-disablement bug and FIPS-enabled RHEL installation failures.

AI summary / analysis; claims are not independently verified. Check the primary source before acting.

Section 02 · Analysis

SecOps Signal analysis
Why it matters

This release introduces critical vulnerability coverage for Python workloads targeting CVE-2025-68664/5 (LangGrinch) while documenting a known service-disablement issue on specific versions and a FIPS-related installation bug on RHEL 8/9.

Operational impact

Hosts running affected MDE versions might experience disabled protection services upon reboot until updated, and FIPS-enabled RHEL 8/9 devices may have failed prior platform updates.

Section 03 · Recommended actions

  • Upgrade affected Linux devices running versions 101.26042.0000–101.26042.0009 to build version 101.26042.0011 or later.
  • Update FIPS-enabled RHEL 8/9 devices to platform version 101.26052.0011 or later to resolve installation failures.
  • Enable real-time protection statistics on-demand using mdatp config real-time-protection-statistics --value enabled when diagnostic data is required.
What to check
  • Verify whether Linux endpoints running Microsoft Defender for Endpoint are on version 101.26042.0000 through 101.26042.0009.
  • Check if any servers have the Defender service disabled following a reboot.
  • Confirm the status of FIPS-enabled RHEL 8 or 9 devices attempting platform updates to version 101.26042.x.

Affected scope

ProductsDefender for Endpoint

Section 04 · References

1 public source
https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-releases#linux-march-2026-101-26012-0007-b2270d7de0f7a7182193413438fbd110784b2f1527692e28301d1595ccdeb168learn.microsoft.com