Affected Systems

Microsoft Defender on Windows systems. Specific product versions not disclosed. Vulnerability allows local attackers to escalate privileges to SYSTEM level through improper link resolution handling.

Exploitation Status

Active exploitation confirmed in the wild. Microsoft has disclosed that both CVE-2026-41091 and an accompanying denial-of-service vulnerability are being actively exploited. No public PoC details available in provided data.

Business Impact

High-severity local privilege escalation enables attackers with initial low-privilege access to gain full SYSTEM control on endpoints running Microsoft Defender. Active exploitation increases risk of ransomware deployment, lateral movement, and persistence establishment. Organizations with compromised endpoints face immediate risk of full system compromise. Defender is deployed by default on most Windows systems, making exposure widespread.

Urgency

🔴 Immediate

Recommended Actions

  • Apply Microsoft security updates for Defender immediately via Windows Update or WSUS
  • Verify Defender definition and platform updates are current on all endpoints using Update-MpSignature PowerShell cmdlet
  • Review Windows Security Event Logs (Event ID 1116, 1117) and Defender operational logs for suspicious privilege escalation attempts
  • Audit local administrator group membership changes and new SYSTEM-level scheduled tasks created in the past 30 days
  • Deploy detection rules for abnormal Defender process behavior, particularly MsMpEng.exe spawning unexpected child processes with SYSTEM privileges