In CISA KEV7.8 HighCWE-59
CVE-2026-41091
Microsoft Defender Link Following Vulnerability
MicrosoftDefender
Status
- Exploited in the wild
- In CISA KEV since 20 May
- Vendor fix available
Federal deadlineWed 3 Jun, 23:59 UTC
Passed 143 days ago
CISA KEV · added 20 May
Exploit probabilityEPSSchecked 24 Oct
0.4%probability of exploitation in the next 30 days
Higher than 38% of scored CVEs
SeverityCVSS
7.8High
Description NVD
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 7 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 20 May · 18:02 UTC | CISA | CISA adds seven KEV flaws, including 2026 Microsoft Defender bugs |
| Wed 20 May · 19:45 UTC | CISA | CISA warns of active exploit in Microsoft Defender CVE-2026-41091 |
| Wed 20 May · 20:13 UTC | CISA | CISA warns of active exploit in Microsoft Defender CVE-2026-41091 |
| Thu 21 May · 10:21 UTC | SecurityWeek | Microsoft fixes two zero day Defender bugs under active attack |
| Thu 21 May · 18:41 UTC | Malwarebytes | Microsoft Defender vulnerabilities are being exploited in the wild |
| Thu 21 May · 21:32 UTC | Security Affairs | CISA Adds Critical Flaws in Windows, Office, Defender to KEV List |
| Tue 9 Jun · 23:49 UTC | Security Affairs | Microsoft patches CVE-2026-41091 amid record 208 CVE update |
- Microsoft patches CVE-2026-41091 amid record 208 CVE updateSecurity Affairs
- CISA Adds Critical Flaws in Windows, Office, Defender to KEV ListSecurity Affairs · mentions it in passing
- Microsoft Defender vulnerabilities are being exploited in the wildMalwarebytes
- Microsoft fixes two zero day Defender bugs under active attackSecurityWeek
- CISA warns of active exploit in Microsoft Defender CVE-2026-41091CISA · official notice
- CISA warns of active exploit in Microsoft Defender CVE-2026-41091CISA · official notice
- CISA adds seven KEV flaws, including 2026 Microsoft Defender bugsCISA · first in our coverage · official notice · mentions it in passing