CVE-2026-41091
Description
CVE-2026-41091 is a high-severity local privilege escalation flaw in Microsoft Defender's Malware Protection Engine, currently under active exploitation.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| malware_protection_engine | 1.1.26030.3008 | 1.1.26040.8 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Microsoft has released updates for the Malware Protection Engine to address this link resolution flaw. Ensure the engine is updated automatically via Windows Update or manually through Microsoft Endpoint Configuration Manager.
Update affected systems
Verify that the Microsoft Malware Protection Engine is updated to version 1.1.26040.8 or later. Systems running versions starting from 1.1.26030.3008 up to 1.1.26040.7 are confirmed vulnerable and require immediate remediation.
Restrict access
Since this is a local privilege escalation (LPE) vulnerability, enforce the principle of least privilege (PoLP) and restrict local interactive login access to sensitive servers to minimize the number of users capable of executing local exploits.
Monitor for exploitation
Utilize EDR and SIEM tools to monitor for suspicious symbolic link or hard link creation in system directories, particularly those associated with Microsoft Defender's temporary file locations or update folders.
Detection Guidance
Detection should focus on identifying unusual file system operations. Monitor Windows Event ID 4663 for attempts to access objects involving symbolic links or junctions created by low-privileged users in system-protected paths. Specifically, look for processes attempting to redirect Defender’s file operations to sensitive system files. Host-based behavioral analysis of symlink creation and 'link following' behavior is the most effective way to identify potential exploitation attempts in real-time.