Two flaws in Microsoft Defender allow privilege escalation and denial-of-service, with active exploitation confirmed.
- Microsoft confirmed active exploitation of two Defender vulnerabilities
- CVE-2026-41091 allows attackers to gain SYSTEM privileges with 7.8 CVSS score
- Second vulnerability enables denial-of-service attacks against Defender
Microsoft has confirmed that attackers are actively exploiting two vulnerabilities in Microsoft Defender in the wild, including a privilege escalation flaw that could allow attackers to gain SYSTEM-level access.
The more severe vulnerability, tracked as CVE-2026-41091, has been assigned a CVSS score of 7.8. The flaw stems from improper link resolution before file access, also known as ‘link following’, in Microsoft Defender.
Successful exploitation of CVE-2026-41091 could allow an attacker to escalate privileges and gain SYSTEM-level access to compromised systems. SYSTEM privileges represent the highest level of access on Windows systems, effectively giving attackers complete control over the affected machine.
Microsoft has also disclosed a second actively exploited vulnerability that enables denial-of-service attacks against Defender, though specific technical details about this flaw were not provided in the available information.
The confirmation of active exploitation indicates that threat actors are already leveraging these vulnerabilities in real-world attacks, making immediate patching a priority for organisations running Microsoft Defender.
Microsoft Defender is widely deployed across enterprise environments as part of the company’s integrated security stack, making these vulnerabilities particularly concerning for organisations that rely on the platform for endpoint protection.
Why It Matters
These actively exploited Defender vulnerabilities present immediate risks to enterprise security posture. The privilege escalation flaw could allow attackers who have already gained initial access to systems to elevate their permissions to SYSTEM level, effectively compromising entire endpoints and potentially enabling lateral movement across networks.
For CISOs, this represents both an immediate operational risk requiring urgent patching and a potential compliance concern, as compromised endpoint security solutions could impact regulatory reporting requirements and audit findings.
What To Do Now
- Apply Microsoft security updates for Defender as soon as they become available from Microsoft’s security advisory channels
- Monitor systems for signs of privilege escalation attempts and unusual Defender behaviour
- Review endpoint detection and response capabilities to identify potential exploitation attempts
