Vulnerability intelligence
CVE-2026-41091
Microsoft Defender Link Following Vulnerability
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
CVSS Score
7.8
High
EPSS — Exploit Probability
8.2%
Riskier than 92% of all CVEs
Exploitation
Confirmed in the wild
Used in ransomware campaigns
Remediation
Patch available
Federal deadline 2026-06-03
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-06-03.
7 articles across 5 outlets · first covered May 20, 2026 · latest Jun 9, 2026
Coverage timeline
-
Microsoft patches CVE-2026-41091 amid record 208 CVE updatesecurityaffairs.com · Jun 9, 2026
-
CISA Adds Critical Flaws in Windows, Office, Defender to KEV Listsecurityaffairs.com · May 21, 2026
-
Microsoft Defender vulnerabilities are being exploited in the wildwww.malwarebytes.com · May 21, 2026
-
Microsoft fixes two zero day Defender bugs under active attackwww.securityweek.com · May 21, 2026
-
CISA warns of active exploit in Microsoft Defender CVE-2026-41091www.cisa.gov · May 20, 2026
-
CISA warns of active exploit in Microsoft Defender CVE-2026-41091cisa.gov · May 20, 2026
-
CISA adds seven KEV flaws, including 2026 Microsoft Defender bugswww.cisa.gov · May 20, 2026