CVE-2026-41091

Published May 20, 2026

Last updated 24 days ago

Exploit known CVSS high 7.8

Microsoft Defender

Zero-day

API

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-41091 is a privilege escalation vulnerability found in Microsoft Defender. The flaw stems from improper link resolution before file access, often referred to as 'link following', within the Microsoft Malware Protection Engine (version 1.1.26030.3008 and earlier). This vulnerability allows an authorized attacker to locally elevate their privileges on an affected system. The issue arises from how Defender processes symbolic links and hard links, enabling attackers to manipulate file system traversal and gain higher-level access. Reports indicate that this vulnerability is already being exploited in the wild.

Description: Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Source: secure@microsoft.com
NVD status: Analyzed
Products: malware_protection_engine

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Microsoft Defender Link Following Vulnerability
Exploit added on: May 20, 2026
Exploit action due: Jun 3, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

secure@microsoft.com: CWE-59

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "AD1882FA-1447-46F7-A592-142F55820A60",
            "versionEndExcluding": "1.1.26040.8",
            "versionStartIncluding": "1.1.26030.3008",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.