Microsoft Defender Vulnerability CVE-2026-41091: Local Privilege Escalation via Improper Link Handling
The National Vulnerability Database has identified CVE-2026-41091, a critical vulnerability within Microsoft Defender. This flaw, stemming from improper link resolution before file access (CWE-59), allows an authenticated local attacker to escalate their privileges on a compromised system. The CVSS score of 7.8 highlights the severity, indicating a high risk for organizations.
While specific affected products are not detailed, the nature of the vulnerability suggests that any system running Microsoft Defender could be at risk. Attackers gaining initial low-privilege access can leverage this flaw to gain administrative control, enabling further lateral movement, data exfiltration, or system disruption.
Defenders must prioritize patching or updating Microsoft Defender installations wherever possible. For systems where immediate patching is not feasible, strict access controls and monitoring for suspicious file access or privilege escalation attempts are crucial. Understanding the attacker’s calculus here is simple: gain a foothold, then exploit this to gain full control.
What This Means For You
- If your organization uses Microsoft Defender, verify that all instances are updated to the latest version. Review access logs for any unusual file operations or privilege escalation attempts that might indicate exploitation of this vulnerability.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-41091: Microsoft Defender Privilege Escalation via Improper Link Handling
title: CVE-2026-41091: Microsoft Defender Privilege Escalation via Improper Link Handling
id: scw-2026-05-20-ai-1
status: experimental
level: high
description: |
This rule detects the execution of Microsoft Defender's command-line utility (MpCmdRun.exe) with specific parameters ('-DownloadFile' or '-RemoveFile') originating from a command shell or PowerShell. This pattern is indicative of an attacker attempting to leverage CVE-2026-41091 to perform local privilege escalation by manipulating file operations through improper link handling within Microsoft Defender.
author: SCW Feed Engine (AI-generated)
date: 2026-05-20
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-41091/
tags:
- attack.privilege_escalation
- attack.t1068
logsource:
category: process_creation
detection:
selection:
Image|endswith:
- 'MpCmdRun.exe'
CommandLine|contains:
- '-DownloadFile'
- '-RemoveFile'
ParentImage|contains:
- 'cmd.exe'
- 'powershell.exe'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-41091 | Privilege Escalation | Microsoft Defender |
| CVE-2026-41091 | Privilege Escalation | Improper link resolution before file access ('link following') |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 20, 2026 at 16:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-20240 — Denial of Service
CVE-2026-20240 — In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129,...
Splunk Enterprise, Cloud Vulnerability Exposes Session Cookies, Sensitive Data
CVE-2026-20239 — In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a...
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data...