CVE-2026-41091

CVE-2026-41091 is a link-following vulnerability in the Microsoft Malware Protection Engine that allows privilege escalation to SYSTEM by exploiting how Defender resolves file paths during scanning. Place a file with a manipulated symlink in a location Defender will scan — the engine resolves the symlink with its elevated privileges and operates on the attacker-specified target instead. This is a classic TOCTOU (time-of-check-time-of-use) flaw in path resolution, not an architectural inevitability. The CISA KEV confirmation signals active exploitation, but the context matters: this is a post-exploitation mechanism. An attacker needs local access first to place the symlink and malicious file. The vulnerability serves as the privilege escalation step in an intrusion — escaping sandboxing or escalating from medium integrity to SYSTEM. Here's what matters operationally. First, treat this as a lateral movement and persistence risk rather than an initial access vector. If an attacker already has code execution on an endpoint at any privilege level, this becomes the escalation path to full control. Second, the blast radius is asymmetric. When you own Defender, you own the process that controls tamper protection, can whitelist malware, suppress security events, and access the telemetry that SOC teams rely on. This isn't just SYSTEM-level code execution — it's seizing the defensive infrastructure itself. Review your detection rules for Defender tampering events (Event ID 1116-1119) and process creation from MpDefenderCore.exe. Third, understand the auto-update surface. The Malware Protection Engine updates frequently and runs with elevated privileges during updates. Monitor for anomalous update behavior and validate that your EDR is watching the update pipeline. On prioritization: given the active exploitation and the consequence of failure, treat this as high-priority for your vulnerability management program — not because it's easily exploitable remotely, but because the impact of exploitation is catastrophic and the attack likely targets already-compromised endpoints in your environment.

Reviewed through automated stages and approved by a human before publication.