Actively exploited in the wild
Microsoft Defender Link Following Vulnerability
Microsoft - Defender · Listed in the CISA KEV since 2026-05-20. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-41091
HighCVSS 7.8KEVExploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Risk Assessment
An authorized user can escalate privileges on the system, potentially leading to access to sensitive data or further lateral movement.
Recommendation
Install the latest Microsoft Defender security updates available via Windows Update.
Original NVD description (English source)
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.