CISA
CISA warns of active exploit in Microsoft Defender CVE-2026-41091
The CISA maintains a Known Exploited Vulnerabilities (KEV) Catalog to assist organizations in managing vulnerabilities and staying updated on threat activities. The current entry details a vulnerability in Microsoft Defender (CVE-2026-41091), which allows an authorized attacker to elevate privileges locally. Related classifications include CWE-59. Organizations are advised to apply vendor mitigation instructions or consider discontinuing the use of the product if mitigations are unavailable. The catalog is available in various formats, including CSV and JSON, and users can subscribe for updates.
Story timeline CVE-2026-41091
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 20 May · 18:02 UTC | CISA | CISA adds seven KEV flaws, including 2026 Microsoft Defender bugs |
| Wed 20 May · 19:45 UTC | CISA | CISA warns of active exploit in Microsoft Defender CVE-2026-41091 |
| Wed 20 May · 20:13 UTC | CISA | CISA warns of active exploit in Microsoft Defender CVE-2026-41091 (this article) |
| Thu 21 May · 10:21 UTC | SecurityWeek | Microsoft fixes two zero day Defender bugs under active attack |
| Thu 21 May · 18:41 UTC | Malwarebytes | Microsoft Defender vulnerabilities are being exploited in the wild |
| Thu 21 May · 21:32 UTC | Security Affairs | CISA Adds Critical Flaws in Windows, Office, Defender to KEV List |
| Tue 9 Jun · 23:49 UTC | Security Affairs | Microsoft patches CVE-2026-41091 amid record 208 CVE update |