CVE-2026-41091

What it actually does

This is a local privilege escalation in the Microsoft Malware Protection Engine caused by improper handling of links before file access. A low-privileged, authenticated attacker can abuse symbolic links, hard links, junctions, or other NTFS reparse-point behavior so that Microsoft Defender performs file operations on an attacker-chosen target while running with elevated privileges. Successful exploitation can allow the attacker to modify, delete, or otherwise influence protected files or locations and may result in SYSTEM-level code execution or equivalent local administrative control. The CVSS vector indicates local access, low attack complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

Because Microsoft Defender is widely deployed and commonly runs with high privileges, this vulnerability can turn an initial low-privilege foothold into full control of an affected Windows system. In practical terms, an attacker who has already gained basic local access can disable defenses, tamper with protected files, install persistence, access sensitive data, and move deeper into the environment. The vulnerability is listed in CISA KEV with active exploitation in the wild and a remediation due date of 2026-06-03, so it should be treated as an urgent endpoint-hardening and incident-review priority even though it is not currently marked as associated with ransomware campaigns.

How an attack unfolds

An attacker first obtains local authenticated access to a Windows host, such as through phishing, stolen credentials, malware execution, or abuse of another vulnerability. The attacker then prepares a file-system object in a location that Microsoft Defender is likely to scan, remediate, quarantine, restore, or otherwise access. Instead of a normal file path, the object is arranged to resolve through a link, junction, hard link, or reparse point to a protected file or directory that the attacker could not normally modify. When Defender processes the attacker-controlled path, the vulnerable link-following logic causes the privileged Defender component to operate on the linked target. By carefully choosing the target and operation, the attacker may cause privileged file modification, deletion, replacement, or other side effects that enable elevation of privilege, defense evasion, persistence, or execution with elevated rights. Public reporting and KEV status indicate active exploitation, so organizations should also assume that exploitation may be chained after initial access rather than used as a standalone remote entry point.

How to fix it

Apply the latest Microsoft Defender antimalware platform and Malware Protection Engine updates from Microsoft, along with current Windows security updates where applicable. Because no exact fixed version was provided in the input, validate against the current Microsoft advisory and ensure the Defender engine/platform version on endpoints is at or above Microsoft's fixed release for this issue. Prioritize systems where users can execute code locally, developer workstations, shared workstations, VDI images, servers with interactive logon, and endpoints exposed to untrusted files. If immediate patching is not possible, reduce local admin availability, restrict untrusted code execution, enforce attack surface reduction rules, monitor and restrict creation of symbolic links/junctions by non-administrative users where feasible, and ensure Defender tamper protection and EDR controls remain enabled. Do not disable Microsoft Defender as a mitigation; update it.

How to confirm the fix worked

Confirm that Microsoft Defender engine and platform components have updated successfully on representative and high-risk endpoints. Use enterprise endpoint management, Defender for Endpoint, PowerShell, or security inventory tooling to collect Defender engine/platform versions and compare them with Microsoft's fixed versions for this vulnerability. Verify that signature, engine, and platform updates are not failing or pinned to old versions. Confirm Windows Update, Microsoft Update, WSUS, Configuration Manager, Intune, or equivalent update channels are delivering Defender platform/engine updates. For exposure validation, identify hosts running the Microsoft Malware Protection Engine and prioritize those where local users can create files, run scripts, or interactively log on. After remediation, run a controlled scan/update validation and confirm Defender services remain healthy and current.

Typical attack path

1. Gain local authenticated access to a Windows endpoint with Microsoft Defender / Microsoft Malware Protection Engine present.
2. Create or manipulate a file-system object using a symbolic link, hard link, junction, or NTFS reparse point in a location Defender will inspect or remediate.
3. Point the link to a privileged target that the attacker cannot directly access or modify.
4. Trigger Defender activity through scan, detection, remediation, quarantine, restore, or related file access behavior.
5. Abuse Defender's elevated file operation to affect the protected target.
6. Leverage the privileged file effect to escalate privileges, weaken endpoint protections, establish persistence, or continue post-exploitation activity.

How to detect it

Look for evidence that a local user created or manipulated file-system links immediately before Microsoft Defender performed privileged file operations. Useful sources include Microsoft-Windows-Windows Defender/Operational logs, Windows Security logs with process creation and object access auditing, Sysmon or EDR telemetry, file-system metadata, USN journal records, MFT artifacts, Defender quarantine history, and endpoint management update/compliance logs. Hunt for non-administrative users running link-creation utilities such as fsutil, mklink through cmd.exe, PowerShell symbolic-link creation, or custom tools invoking reparse-point behavior. Correlate those events with MsMpEng.exe or MpCmdRun.exe accessing, deleting, quarantining, restoring, or modifying files in protected locations such as Windows, Program Files, service directories, driver paths, scheduled task locations, startup locations, or security product directories. Also review for post-exploitation outcomes: new local administrators, modified services, replaced binaries, suspicious scheduled tasks, disabled security tooling, tamper protection alerts, unexpected Defender exclusions, or credential access activity after the suspected link abuse. Because this is a privilege-escalation flaw, exploitation will usually appear after initial access; correlate with earlier suspicious logons, malware detections, script execution, or remote management activity.

• MsMpEng.exe
• MpCmdRun.exe
• fsutil hardlink create
• fsutil reparsepoint
• mklink
• New-Item -ItemType SymbolicLink
• New-Item -ItemType Junction
• FSCTL_SET_REPARSE_POINT
• CreateSymbolicLink
• Microsoft-Windows-Windows Defender/Operational
• Defender\Quarantine
• Windows Defender\Quarantine
• Tamper Protection
• Add-MpPreference -ExclusionPath
• Set-MpPreference

What your security team should do

• Treat this as high priority because it is in CISA KEV, has active exploitation in the wild, and the KEV remediation due date is 2026-06-03.
• Inventory all Windows endpoints and servers running Microsoft Defender / Microsoft Malware Protection Engine and verify Defender engine/platform currency.
• Accelerate deployment of Microsoft Defender platform and engine updates through managed update channels; investigate endpoints that fail to update.
• Hunt for recent local privilege escalation behavior on Windows hosts, especially suspicious link or reparse-point creation followed by Defender file activity.
• Review EDR telemetry for low-privileged users invoking link-creation utilities or APIs shortly before privileged file changes, service modifications, or security control tampering.
• Prioritize investigation of systems with unexplained Defender service activity, unusual quarantine/restore behavior, tamper protection alerts, or new persistence mechanisms.
• Ensure tamper protection, behavior monitoring, cloud-delivered protection, and attack surface reduction rules are enabled where operationally feasible.
• Limit interactive logon and script execution rights on servers and high-value endpoints until remediation coverage is confirmed.
• If exploitation is suspected, preserve forensic artifacts before remediation where possible, including Defender operational logs, Security logs, Sysmon/EDR telemetry, USN journal data, and suspicious file-system metadata.