{"schema":"vulnpedia.research/1","cve":"CVE-2026-41091","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091","tags":["vendor-advisory","patch","Vendor Advisory","KEV report"],"source":"mitre","sourceId":"microsoft","modified":"2026-08-10T15:13:49.938Z","origins":[{"source":"mitre","sourceId":"microsoft","modified":"2026-08-10T15:13:49.938Z","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091"},{"source":"nvd","sourceId":"CVE-2026-41091","modified":"2026-07-24T10:10:00.197","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091"},{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","modified":"2026-05-19T00:00:00Z","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41091","tags":["government-resource","Third Party Advisory","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-05-21T03:55:23.197Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-05-21T03:55:23.197Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41091"},{"source":"nvd","sourceId":"CVE-2026-41091","modified":"2026-07-24T10:10:00.197","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41091"}]},{"source":"euvd","sourceId":"EUVD-2026-31101","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31101","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-31101","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31101"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-41091","modified":"2026-05-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","modified":"2026-05-19T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-May","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-41091","modified":"2026-05-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","modified":"2026-05-19T00:00:00Z","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-May"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-41091","modified":"2026-05-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","modified":"2026-05-19T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-41091","modified":"2026-05-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","modified":"2026-05-19T00:00:00Z","url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape"}]},{"url":"https://vulncheck.com/xdb/f05609d99a35","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"f05609d99a35","modified":"2026-05-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"f05609d99a35","modified":"2026-05-19T00:00:00Z","url":"https://vulncheck.com/xdb/f05609d99a35"}]},{"url":"https://github.com/s4m98/RedSun-","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"f05609d99a35","modified":"2026-05-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"f05609d99a35","modified":"2026-05-19T00:00:00Z","url":"https://github.com/s4m98/RedSun-"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/0xBlackash/CVE-2026-41091","source":"poc-in-github","sourceId":"CVE-2026-41091","description":"CVE-2026-41091","modified":"2026-09-26T13:09:59Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-41091","url":"https://github.com/0xBlackash/CVE-2026-41091"},{"source":"poc-in-github","sourceId":"CVE-2026-41091","modified":"2026-09-26T13:09:59Z","url":"https://github.com/0xBlackash/CVE-2026-41091"}],"tags":[]},{"url":"https://github.com/ridhinva/defender-privilege-escalation-scanner","source":"poc-in-github","sourceId":"CVE-2026-41091","description":"Scanner: CVE-2026-41091/45498 Microsoft Defender LPE/DoS — Python scanner for Windows Defender privilege escalation (CISA KEV)","modified":"2026-08-07T20:36:44Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-41091","url":"https://github.com/ridhinva/defender-privilege-escalation-scanner"},{"source":"poc-in-github","sourceId":"CVE-2026-41091","modified":"2026-08-07T20:36:44Z","url":"https://github.com/ridhinva/defender-privilege-escalation-scanner"}],"tags":[]},{"url":"https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit","source":"poc-in-github","sourceId":"CVE-2026-41091","description":"CVE-2026-41091 RedSun | Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\\SYSTEM - via Cloud Files API + NTFS junction trickery. Forces Defender to write malicious payloads to System32 with SYSTEM rights - Actively exploited in wild. CVSS 7.8. Patch: Defender Engine 1.1.26040.8. Educational & Legal uses only.","modified":"2026-10-16T21:27:15Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-41091","url":"https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit"},{"source":"poc-in-github","sourceId":"CVE-2026-41091","modified":"2026-10-16T21:27:15Z","url":"https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit"}],"tags":[]},{"url":"https://github.com/s4m98/RedSun-","source":"poc-in-github","sourceId":"CVE-2026-41091","description":"Windwos Zero Day Local PrivESc Exploit (CVE-2026-41091)","modified":"2026-08-09T14:02:19Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-41091","url":"https://github.com/s4m98/RedSun-"},{"source":"poc-in-github","sourceId":"CVE-2026-41091","modified":"2026-08-09T14:02:19Z","url":"https://github.com/s4m98/RedSun-"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"f05609d99a35","url":"https://vulncheck.com/xdb/f05609d99a35","cve":"CVE-2026-41091","dateAdded":"2026-08-09T11:23:46Z","modified":"2026-05-19T00:00:00Z","exploitType":"local","repositoryUrl":"https://github.com/s4m98/RedSun-","observations":[{"dateAdded":"2026-08-09T11:23:46Z","exploitType":"local"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"f05609d99a35","modified":"2026-05-19T00:00:00Z","url":"https://vulncheck.com/xdb/f05609d99a35"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-05-19T00:00:00Z","modified":"2026-05-19T00:00:00Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Microsoft","product":"Defender","dueDate":"2026-06-03T00:00:00Z","cisaDateAdded":"2026-05-20T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","modified":"2026-05-19T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","catalog":"VulnCheck KEV","kind":"report","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-May","dateAdded":"2026-05-19T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-May"},{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","dateAdded":"2026-05-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","catalog":"VulnCheck KEV","kind":"report","url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape","dateAdded":"2026-07-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-41091","url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape"}]}]}