Microsoft Defender Local Privilege Escalation Vulnerability (CVE-2026-41091) Technical Advisory

1. Apply Official Security Patches

Apply the latest cumulative Windows updates provided by Microsoft to update the Defender engine.

2. Verify and Force Update Microsoft Defender Engine

Run Windows PowerShell as an Administrator to check the current Defender engine version and force an update:

# Check Defender component versions
Get-MpComputerStatus | Select-Object AMEngineVersion, AMProductVersion, AntispywareSignatureVersion

# Force update Defender signatures and engine
Update-MpSignature

3. Temporary Mitigations (If patching is delayed)

• Enforce Least Privilege: Restrict local user privileges and block untrusted users from establishing local sessions.
• Behavioral Monitoring: Use Endpoint Detection and Response (EDR) tools to monitor and block suspicious symbolic link or junction creation originating from user-writable directories (e.g., C:\Users\*\AppData).

This vulnerability (CVE-2026-41091) is an 'Improper Link Resolution Before File Access' (Link Following, CWE-59) vulnerability in Microsoft Defender.

Exploit Mechanics

• Privilege Discrepancy: Microsoft Defender operates with high privileges (NT AUTHORITY\SYSTEM) when performing real-time protection and system scans.
• Symbolic Link Creation: A local attacker with low privileges creates a malicious symbolic link or directory junction in a temporary directory or log path that Defender frequently accesses.
• TOCTOU & Privilege Escalation: When Defender accesses the path, it follows the link to a protected system file instead of the intended target. This allows the attacker to overwrite critical system files or execute arbitrary code with system-level privileges, achieving Local Privilege Escalation (LPE).

Threat Intelligence Perspective

This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, confirming active exploitation in the wild. With an EPSS score of 0.94 (94%), this flaw is highly likely to be leveraged by threat actors, including ransomware groups and APT campaigns, for lateral movement and privilege escalation. Immediate remediation is strongly advised.