CVE intelligenceCISA KEV

CVE-2026-41091

Microsoft Defender Link Following Vulnerability

Published May 20, 2026Sources checked Sep 27, 2026

7.8HIGHCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2026-41091 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Microsoft Defender.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploit: Not collected. Review the linked vendor advisory and apply the mitigation or fixed release for your affected product.

Microsoft Security Response Center: Exploitation reported by Microsoft Security Response Center (2026-05-26)

CISA KEVListedObserved exploitation

EPSS0.4%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-41091?

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.