CVE-2026-41091
HIGH 7.8 KNOWN EXPLOITED PoC CATALOGUED ALL-YEARSImproper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Confirmed exploited in the wild — in CISA KEV since 2026-05-20. Patch or mitigate now.
Exploitation likelihood
8.2%chance of exploitation in 30 days · 95th percentile
Impact if exploited
7.8CVSS 3.1 · HIGH · CNA
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
Public PoC or exploit resources are catalogued below.
Listed by the named source; Vulnpedia has not tested these resources.
PoC data: JSON
Resource commands
curl -s https://vulnpedia.com/cve/CVE-2026-41091/poc.jsonMachine-readable PoC index for this CVE (for automation).Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-59: : Improper Link Resolution Before File Access ('Link Following')
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
References and research data (JSON)
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
4 candidates
- https://github.com/0xBlackash/CVE-2026-41091
CVE-2026-41091
PoC-in-GitHub · CVE-2026-41091
PoC-in-GitHub · CVE-2026-41091 · Updated 2026-09-26T13:09:59Z - https://github.com/ridhinva/defender-privilege-escalation-scanner
Scanner: CVE-2026-41091/45498 Microsoft Defender LPE/DoS — Python scanner for Windows Defender privilege escalation (CISA KEV)
PoC-in-GitHub · CVE-2026-41091
PoC-in-GitHub · CVE-2026-41091 · Updated 2026-08-07T20:36:44Z - https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit
CVE-2026-41091 RedSun | Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM - via Cloud Files API + NTFS junction trickery. Forces Defender to write malicious payloads to System32 with SYSTEM rights - Actively exploited in wild. CVSS 7.8. Patch: Defender Engine 1.1.26040.8. Educational & Legal uses only.
PoC-in-GitHub · CVE-2026-41091
PoC-in-GitHub · CVE-2026-41091 · Updated 2026-10-16T21:27:15Z - https://github.com/s4m98/RedSun-
Windwos Zero Day Local PrivESc Exploit (CVE-2026-41091)
PoC-in-GitHub · CVE-2026-41091
PoC-in-GitHub · CVE-2026-41091 · Updated 2026-08-09T14:02:19Z
Additional exploitation reports
Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.
- VulnCheck KEV · 2026-05-19T00:00:00Z
Source guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Source ransomware assessment: Unknown
VulnCheck KEV · CVE-2026-41091 · Updated 2026-05-19T00:00:00Z - VulnCheck KEV · 2026-05-19T00:00:00ZVulnCheck KEV · CVE-2026-41091
VulnCheck KEV · CVE-2026-41091 - VulnCheck KEV · 2026-05-20T00:00:00ZVulnCheck KEV · CVE-2026-41091
- VulnCheck KEV · 2026-07-10T00:00:00ZVulnCheck KEV · CVE-2026-41091
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Microsoft | Malware Protection Engine | ≥ 1.1.26030.3008 and < 1.1.26040.8 |
All CVSS metrics
- HIGH 7.8 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - HIGH 7.8 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Patches & mitigations
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091 CVE record · microsoft · Updated 2026-08-10T15:13:49.938Z
NVD · CVE-2026-41091 · Updated 2026-07-24T10:10:00.197
VulnCheck KEV · CVE-2026-41091 · Updated 2026-05-19T00:00:00Z
Advisories
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41091 CVE record · CISA-ADP · Updated 2026-05-21T03:55:23.197Z
NVD · CVE-2026-41091 · Updated 2026-07-24T10:10:00.197 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31101 EUVD · EUVD-2026-31101
- https://vulncheck.com/kev VulnCheck KEV · CVE-2026-41091 · Updated 2026-05-19T00:00:00Z
Technical & other
- https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-May VulnCheck KEV · CVE-2026-41091 · Updated 2026-05-19T00:00:00Z
- https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json VulnCheck KEV · CVE-2026-41091 · Updated 2026-05-19T00:00:00Z
- https://www.recordedfuture.com/blog/june-2026-cve-landscape VulnCheck KEV · CVE-2026-41091 · Updated 2026-05-19T00:00:00Z
- https://vulncheck.com/xdb/f05609d99a35 VulnCheck KEV · f05609d99a35 · Updated 2026-05-19T00:00:00Z
- https://github.com/s4m98/RedSun- VulnCheck KEV · f05609d99a35 · Updated 2026-05-19T00:00:00Z
Sources: NVD · CVE.org · All sources and attribution · EPSS