May 20, 2026 · Applied Cybernetics Group
CVE-2026-41091 — Microsoft Defender
Microsoft Defender Link Following Vulnerability
- Added to KEV
2026-05-20- Federal due date
2026-06-03- Vendor
- Microsoft
- Product
- Defender
- EPSS
- 94.3th percentile (score 0.084, as of
2026-07-13) - NVD CVSS v3.1
- 7.8 (HIGH)
- Ransomware use
- Unknown
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2026-41091
CISA short description
Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
NVD description
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.