CVE-2026-41091highunder attackCWE-59

CVE-2026-41091: high-severity vulnerability in Microsoft Malware Protection Engine

Microsoft Defender Elevation of Privilege Vulnerability

Published · Updated

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 0.4%
from disclosure to weapon1 days
Published on NVDMay 20
1st PoC+1d
CISA KEVMay 20
exploitation probability
0.4%top 63% of all CVEs
observed exploitation
yesCISA + VulnCheck
5 public exploit(s)
Action required by CISAfederal deadline: 2026-06-03

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Microsoft Defender incorrectly handles file links, allowing an authorized user on your computer to gain higher privileges and take control of the system. This is a local attack that requires someone with basic access to exploit.

Technical detail

CWE-59 (link following) vulnerability in Microsoft Defender's file access mechanism allows privilege escalation when an authenticated local user can manipulate symbolic or hard links to redirect file operations. The vulnerability requires local access and valid credentials but bypasses privilege boundary controls.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Affected products
Microsoft · Microsoft Malware Protection Engine
public PoCs found — 5
githubgithub.com/0xBlackash/CVE-2026-41091★ 11githubgithub.com/tc4dy/CVE-2026-41091-PoC-Exploit★ 3githubgithub.com/s4m98/RedSun-★ 1githubgithub.com/ridhinva/defender-privilege-escalation-scanner★ 0vulncheckvulncheck.com/xdb/f05609d99a35unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Malware Protection Engine

In the same product, most dangerous first.

CVE-2021-31985HIGHMicrosoft Defender Remote Code Execution VulnerabilityEPSS 7.8%CVE-2021-42298HIGHMicrosoft Defender Remote Code Execution VulnerabilityEPSS 5.8%CVE-2023-24860HIGHMicrosoft Defender Denial of Service VulnerabilityEPSS 3.0%CVE-2022-24548MEDIUMMicrosoft Defender Denial of Service VulnerabilityEPSS 3.0%CVE-2021-34522HIGHMicrosoft Defender Remote Code Execution VulnerabilityEPSS 2.7%CVE-2021-34464HIGHMicrosoft Defender Remote Code Execution VulnerabilityEPSS 2.6%
References
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41091