CVE-2026-41091: listed in the CISA KEV catalog
CVE-2026-41091 · CVSS 7.8 HIGH · EPSS <1% · KEV 2026-05-20 · patch available
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Is CVE-2026-41091 exploited?
- Listed in the CISA KEV catalog on 2026-05-20.
- Federal remediation due 2026-06-03.
- Past that date by 119 days.
- EPSS puts exploitation in the next 30 days at <1%.
- Public exploit code: none found in monitored sources.
Which products and versions are affected?
- Microsoft · Microsoft Malware Protection Engine · < 1.1.26040.8
Is there a patch?
What PlainSec published about CVE-2026-41091
PlainSec has not published a story about this CVE.
Primary sources
KEV and EPSS are re-checked daily. Record last updated 2026-09-24.