Microsoft Defender Local Privilege Escalation (CVE-2026-41091)

Historical catalog analysis: CISA added this entry on May 20, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-41091 is a link following vulnerability (CWE-59) identified in Microsoft Defender. This flaw allows an attacker who already possesses authorized access to the system to elevate their privileges locally. The vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog on May 20, 2026.

Exposure and applicability

This vulnerability affects systems running Microsoft Defender. Because this is a local privilege escalation (LPE) flaw, the primary exposure path requires an attacker to have already established a foothold or possess valid credentials on the affected endpoint. The risk is most acute in environments where strict adherence to the principle of least privilege is not enforced, as the vulnerability provides a mechanism for an authorized user to gain higher-level system permissions.

Remediation priorities

Based on the inclusion of this flaw in the CISA catalog, remediation should be prioritized for high-value assets and endpoints with multiple authorized users. Our analysis suggests the following priority sequence:

1. Vendor Mitigation Deployment: The primary corrective action is to apply mitigations as specified by Microsoft. Organizations should reference the MSRC update guide for this specific CVE to identify the necessary updates.
2. Cloud Service Alignment: For organizations utilizing Defender via cloud services, remediation should align with BOD 22-01 guidance to ensure consistent exposure reduction across hybrid environments.
3. Asset Decommissioning: In scenarios where vendor mitigations are unavailable or cannot be applied due to legacy constraints, the product should be discontinued on those specific assets to eliminate the attack vector.

How to validate remediation

Verification must move beyond simple version checks, as a deployed update does not always guarantee that the vulnerability is neutralized in the active runtime environment. To verify that exposure has been reduced, defenders should:

• Confirm Mitigation Application: Use configuration management tools to verify that the specific vendor-provided fix or registry change associated with CVE-2026-41091 is present across all targeted endpoints.
• Verify Resultant State: Where possible, use authorized security validation tools to confirm that the link following behavior (CWE-59) no longer allows for unauthorized privilege transitions.

Limits and open questions

While the vulnerability is listed as known to be exploited, it remains unknown whether this flaw has been utilized by ransomware campaigns. Furthermore, while CISA has established a remediation deadline of June 3, 2026, for federal agencies, this date serves as a risk indicator rather than a mandatory requirement for private sector organizations. Residual risk remains if the attacker possesses other methods of privilege escalation or if mitigations are applied inconsistently across the fleet.

Source and editorial note

CVE-2026-41091: Microsoft Defender Link Following Vulnerability · Source date: May 20, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: May 23, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 11, 2026 at 00:06 UTC.

Request a Vulnerability Assessment