CVE-2026-41091

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jul 24, 2026

Description

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

VendorProductVersions
MicrosoftMicrosoft Malware Protection Engine>= 1.1.0.0, < 1.1.26040.8

References

Timeline

Published
May 20, 2026
Last modified
Jul 24, 2026
Added to CISA KEV
May 20, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-410927.8Improper access control in Microsoft Kinect allows an authorized attacker to elevate privileges locally.CVE-2026-410948.8Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over CVE-2026-410957.8Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.CVE-2026-410969.8Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.CVE-2026-410976.7Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-410988.4Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an authorized attacker to peCVE-2026-41106.1The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in thCVE-2026-411004.4Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.CVE-2026-411015.5Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.CVE-2026-411025.5Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.CVE-2026-411039.1Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira &amp; Confluence allows an unauthorized attacker to elCVE-2026-411047.5Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network
CVE-2026-41091: High severity, CVSS 7.8 | Vulnix