Brief Summary: CVE-2026-41091 — Microsoft Defender Elevation of Privilege via Link Following

Introduction

An actively exploited link-following flaw in the Microsoft Malware Protection Engine lets any local user with low privileges escalate to SYSTEM without any user interaction. That turns a foothold into full host compromise. Microsoft Defender holds the largest share of the modern endpoint security market, so defenders and incident responders have a very large number of potentially affected systems to account for.

Technical Information

Root Cause

CVE-2026-41091 falls under CWE-59: Improper Link Resolution Before File Access, usually called "link following." The Microsoft Malware Protection Engine, which underpins Microsoft Defender, runs as a highly privileged SYSTEM service. When the engine performs file operations, it resolves filenames without adequately checking whether those filenames point to symbolic links, junctions, or shortcuts that redirect to unintended resources.

This is a well-understood class of Windows privilege escalation bug. A low-privilege user can create a symbolic link or NTFS junction in a location where the Defender engine performs file operations. The engine does not validate the link target before acting on it, so it carries out the resulting file operation (write, delete, or permission change) with SYSTEM privileges against whatever resource the link points to.

CVSS 3.1 Breakdown

Attack Flow

1. Initial Access: The attacker must already have local, authenticated access to the target system with at least low-level privileges.
2. Link Creation: The attacker places a crafted symbolic link or junction in a directory where the Malware Protection Engine performs file operations. The link resolves to a sensitive system resource the attacker has chosen.
3. Engine Trigger: The Malware Protection Engine, running as SYSTEM, encounters the crafted link during its normal file access routines (such as scanning or quarantine operations).
4. Improper Resolution: The engine follows the link without validating its target and performs the intended file operation against the attacker-controlled destination.
5. Privilege Escalation: The operation executes under the SYSTEM context, so the attacker effectively gains SYSTEM-level control. That allows arbitrary file manipulation, security tool bypass, and full host compromise.

Important Exploitability Condition

Microsoft has clarified that systems with Microsoft Defender disabled are not in an exploitable state, even if vulnerability scanners detect the vulnerable engine binaries on disk. The engine must be actively running for the link-following behavior to trigger.

Affected Systems and Versions

Any system running Microsoft Defender with the Malware Protection Engine at version 1.1.26030.3008 or earlier is affected. This includes Windows endpoints and servers where Defender is the active antimalware solution.

Vendor Security History

Because it is deployed so widely, Microsoft Defender has been a recurring target for privilege escalation research. Microsoft's endpoint security market share grew from 25.8 percent in 2023 to 28.6 percent in 2024, and according to IDC it has been the number one modern endpoint security product for three consecutive years. With that share, any vulnerability in the Malware Protection Engine has an outsized impact on enterprises worldwide. The Hong Kong CERT alert that covers CVE-2026-41091 also references several other Microsoft product vulnerabilities being exploited at the same time, which shows how broad the attack surface of Microsoft products is.

References

• Microsoft Security Response Center Advisory for CVE-2026-41091
• NVD Entry for CVE-2026-41091
• CVE Record: CVE-2026-41091
• Hong Kong CERT High Threat Security Alert (A26-05-33)
• CWE-59: Improper Link Resolution Before File Access
• Microsoft Defender Antivirus Update Management
• Microsoft Ranked Number One in Modern Endpoint Security Market Share
• Help Net Security: Microsoft Patches 80+ Vulnerabilities
• PT Security: CVE-2026-41091 Advisory