CVE-2026-41091: Microsoft Defender Link Following Vulnerability
Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.
Overview
Microsoft Defender's Malware Protection Engine contains a link-following flaw that a local, low-privileged attacker can exploit to gain elevated access on the affected system. By planting a crafted symbolic link or directory junction at a path the engine accesses during its privileged operation, an attacker can redirect file operations to attacker-chosen locations. Versions of the Malware Protection Engine below 1.1.26040.8 are affected.
Vulnerability details
CWE-59 (Link Following) describes a class of flaw where a privileged process resolves a symbolic link or directory junction without verifying that the resolved target is the intended one. In this case, the Microsoft Malware Protection Engine runs with high privilege on the host. The available sources do not specify which Defender operation reaches the vulnerable code path. When it accesses a filesystem path without adequately validating whether that path has been replaced by an attacker-controlled link, the engine's privileged file operations are redirected to a location the attacker designates rather than the intended target.
An attacker with a local, authenticated foothold and at least low-privilege access plants a symbolic link or directory junction at a path the Malware Protection Engine will follow during its privileged operation. When the engine resolves that link, it reads from or writes to the attacker-chosen target under its elevated context. This gives the attacker high confidentiality, integrity, and availability impact on the local system, effectively allowing them to read protected files, corrupt or overwrite privileged data, or disrupt system components they could not otherwise touch.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor for new symbolic links or directory junctions created by standard user accounts in directories accessible to system-level processes. On Windows, Sysmon event ID 27 (FileSymlinkDetected) or object-creation audit events can surface this; creation by a non-administrative account in a shared or temp path warrants review.
- Review Windows Security event logs for privilege-use or object-access events where a process running under a user context gains access to files owned by SYSTEM or TrustedInstaller, particularly if no corresponding administrative session or elevation prompt precedes the access.
Remediation
Additional hardening
- Update the Microsoft Malware Protection Engine to version 1.1.26040.8 or later. Defender typically updates the engine automatically via Windows Update; confirm the installed engine version in Windows Security settings or via PowerShell (Get-MpComputerStatus).
- Apply the principle of least privilege: restrict interactive local logon rights to only accounts that require them, reducing the pool of principals who can plant symlinks or junctions in positions the engine will follow.
- Audit local user account permissions and remove unnecessary write access to directories used by system-level processes, limiting an attacker's ability to position a crafted link at a path the Malware Protection Engine traverses.
- Where feasible, deploy Windows Defender Credential Guard and enable audit policies for object access and privilege use to improve visibility into file-system manipulation attempts on sensitive paths.
Key dates
References
Frequently asked questions
Does CVE-2026-41091 affect my FedRAMP authorization?
If Microsoft Defender runs inside your authorization boundary, yes. CVE-2026-41091 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of June 3, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV is a finding. An overdue one is a finding your assessor and sponsoring agency can already see. Remediate now or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-41091?
Knox does not patch your software. Remediating Microsoft Defender is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with Knox's automated continuous monitoring platform and audit-artifact coverage to document the fix for your next assessment. The remediation is yours to apply; maintaining a compliant posture while you apply it is not something you have to manage alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including CVE-2026-41091. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you a materially shorter window between disclosure and visibility.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-41091's remediation deadline of June 3, 2026 has passed. What happens now?
If CVE-2026-41091 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing the finding out and documenting why the deadline slipped is what keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
