KB4052623: Microsoft Defender antimalware platform update (version 4.18.26050.15)

Summary

KB4052623 is the standing KB identifier Microsoft uses for all Microsoft Defender Antivirus antimalware platform updates. The specific package covered here carries platform version 4.18.26050.15 and is labeled Current Channel (Broad), meaning it is the final stage of Microsoft's gradual monthly rollout. It is distributed through Windows Update, WSUS, and the Microsoft Update Catalog - not through a dedicated support.microsoft.com article.

What this update does

KB4052623 is not a one-time fix with a finite list of resolved issues. It is the persistent KB number Microsoft assigns to every periodic platform update for Microsoft Defender Antivirus. As the official Microsoft Learn documentation states, Microsoft Defender Antivirus requires monthly updates (KB4052623) known as platform updates.

The platform update is distinct from the daily security intelligence (definition) updates that arrive multiple times a day under KB2267602. Platform updates apply to the overall Defender infrastructure, including new features, OS-level integration, bug fixes, and improvements - and these updates are provided in KB4052623.

The Microsoft Security Intelligence page confirms that platform version 4.18.26050.15 was released on 6/26/2026. The version string follows the format 4.18.YYMM0.revision, where 26050 encodes year 2026 and month 05, and .15 is the revision within that release.

The Current Channel (Broad) label identifies where this package sits in Microsoft's gradual rollout pipeline. Current Channel (Broad) devices are offered updates only after the gradual release cycle completes, and this channel is suggested for a broad set of devices in the production population (approximately 10-100%). In practice, this is the most conservative standard channel and the one most production endpoints land on by default or by explicit policy.

Updates are released monthly using a gradual release process that helps enable early failure detection - identifying issues as they occur and addressing them quickly before a larger rollout.

Because KB4052623 is an evergreen platform identifier and not a named security bulletin, Microsoft does not publish a per-version changelog within the KB number itself. Detailed per-release notes for the platform are maintained on the Microsoft Defender for Endpoint release notes page on Microsoft Learn.

How to get this update

Microsoft Defender Antivirus requires monthly updates (KB4052623) known as platform updates, and you can manage the distribution of updates using the usual methods you use to deploy Microsoft and Windows updates to endpoints in your network.

Monthly updates are released in phases, resulting in multiple packages visible in your Windows Server Update Services. Enterprise administrators managing updates through WSUS, Microsoft Configuration Manager (ConfigMgr), or Microsoft Intune will find the platform packages available in those channels once the gradual rollout reaches the Broad stage.

For manual or offline deployment, the package can be downloaded directly from the Microsoft Update Catalog. If you are manually deploying the Microsoft Defender Antivirus Platform Update, or using a script or a non-Microsoft management product to deploy it, make sure that version 4.18.2001.10 is installed from the Microsoft Update Catalog before the latest version of Platform Update (N-2) is installed. This is the documented minimum prerequisite for manual deployment paths.

Platform updates can be temporarily postponed if other protection features, such as Endpoint DLP or Device Control, are actively monitoring running processes. Platform updates are retried after a reboot or when all monitored services are stopped.

Known issues

Microsoft lists no known issues for this update at the time of writing. The Microsoft Security Intelligence page notes the platform version and release date without any associated known-issue statement.

Frequently asked questions

What exactly does this update change in Microsoft Defender?

KB4052623 updates the core antimalware platform binaries for Microsoft Defender Antivirus - the host-level infrastructure layer that governs scanning behavior, OS integration, and feature support. It is separate from daily definition (signature) updates. Engine updates target the core scanning engine that detects and removes malware, while security intelligence updates provide the latest threat definitions and detection logic - those arrive multiple times a day via KB2267602.

Does installing this update require a restart?

A restart is not guaranteed to be required but may be needed in some cases. Platform updates can be temporarily postponed if other protection features such as Endpoint DLP or Device Control are actively monitoring running processes, and platform updates are retried after a reboot or when all monitored services are stopped. Plan for a possible restart in managed environments.

What does "Current Channel (Broad)" mean for my organization?

It identifies which stage of Microsoft's phased rollout this package targets. Current Channel (Broad) devices are offered updates only after the gradual release cycle completes, and this channel is suggested for a broad set of devices in the production population. You can control which channel your endpoints use via Group Policy, Microsoft Intune, or ConfigMgr.

How do I manually obtain this update or verify the installed version?

The package is available from the Microsoft Update Catalog. To verify the platform version currently installed on an endpoint, open an elevated PowerShell session and run Get-MpComputerStatus | Select AMProductVersion. The platform binaries are located in %ProgramData%\Microsoft\Windows Defender\Platform\<antimalware platform version>. The current and historical platform versions are also listed on the Microsoft Security Intelligence page.