CVE-2026-41091 is a CVSS 7.8 elevation of privilege vulnerability in Microsoft Defender that Microsoft marks as exploited and publicly disclosed. It came in Microsoft’s May 2026 security update release, alongside two more Defender CVEs, and the fix arrives through the Defender engine and platform channel rather than a Windows KB. Check your engine is at least 1.1.26040.8 and your platform at least 4.18.26040.7.
Microsoft’s May 2026 security update release included three Microsoft Defender vulnerabilities you need to be aware of. The most urgent is CVE-2026-41091 — a CVSS 7.8 elevation of privilege vulnerability that Microsoft marks both Exploited: Yes and Publicly Disclosed: Yes, with the label "Exploitation Detected". The fixes ship in the Defender engine and platform rather than in a Windows cumulative update, so the version check below is what matters, not whether a KB installed. If your engine is behind 1.1.26040.8 or your platform behind 4.18.26040.7, that needs to change today.
Zero-day: already exploited in the wild
Microsoft already marked CVE-2026-41091 as exploited when it published the CVE in its May 2026 release, and marks it publicly disclosed as well. This is not a theoretical risk. Prioritise the Defender engine and platform update above your standard patching cadence.
1.1.26040.8 and platform 4.18.26040.7, so the previous figures would have flagged already-patched devices as vulnerable. CVSS scores and the component mapping are now filled in from Microsoft’s records.The Three Defender CVEs — May 2026
| CVE | Type | CVSS | Severity | Fix | Exploited |
|---|---|---|---|---|---|
| CVE-2026-41091 | Elevation of Privilege | 7.8 | Important | Engine 1.1.26040.8 | YES — Zero-day |
| CVE-2026-45498 | Denial of Service | 4.0 | Low | Platform 4.18.26040.7 | YES |
| CVE-2026-45584 | Remote Code Execution | 8.1 | Critical | Engine 1.1.26040.8 (already shipped) | No |
CVE-2026-41091 Detail: How the Attack Works
CVE-2026-41091 is an elevation of privilege vulnerability rooted in improper file-link handling in Microsoft Defender. An attacker who already has a local user account on the target system can exploit this vulnerability to elevate their privileges to SYSTEM level or equivalent.
The attack chain:
Requires an authorized local attacker
The attacker must already have a foothold — a local user account or compromised session on the target machine. This is not a remote unauthenticated attack vector.
Exploits Defender's file-link handling
Defender processes certain file system links (symlinks, junction points, or hardlinks) in a way that allows privilege confusion. The attacker crafts a malicious file-link that causes Defender to operate on a target file with elevated privileges.
Privileges are elevated to SYSTEM
The result is local privilege escalation — a standard user account can obtain SYSTEM-level access. Combined with other vulnerabilities or malware, this turns a limited compromise into full device control.
CVE-2026-45584: Critical RCE — Same Engine Build as the Exploited One
CVE-2026-45584 is rated Critical and is a heap buffer overflow in the Defender scanning engine that allows remote code execution. This is the most severe of the three CVEs. The good news: Microsoft lists its first fixed build as Engine version 1.1.26040.8 — the same build that fixes the exploited CVE-2026-41091 — delivered through the Defender engine update channel rather than on Patch Tuesday.
Defender engine updates flow through Microsoft Update independently of the monthly Windows OS update. If your devices receive Defender engine updates automatically (the default for most environments), they likely already have this fix. Verify using the version check below.
How to Check Your Defender Versions
Run this in PowerShell on any Windows device to see the current Defender engine and platform versions:
Get-MpComputerStatus | Select-Object AMEngineVersion, AMProductVersion, AMServiceEnabled, AntispywareEnabled, RealTimeProtectionEnabledCheck these values against the target versions:
| Component | Minimum required version | What it patches |
|---|---|---|
| Engine (AMEngineVersion) | 1.1.26040.8 or later | CVE-2026-41091 (exploited EoP) and CVE-2026-45584 (Critical RCE) |
| Platform (AMProductVersion) | 4.18.26040.7 or later | CVE-2026-45498 (exploited DoS). Microsoft lists the last affected platform as 4.18.26030.3011. |
| Engine (CVE-2026-45584 RCE fix) | 1.1.26040.8 or later | CVE-2026-45584 (Critical RCE heap buffer overflow) |
For fleet-wide visibility via Defender advanced hunting:
DeviceTvmSoftwareInventory
| where SoftwareName == "windows_defender"
| summarize arg_max(Timestamp, *) by DeviceId
| project DeviceName, SoftwareVersion, OSPlatform
| where SoftwareVersion < "1.1.26040.8"
| order by DeviceName ascWhere These Fixes Sit in the Release Calendar
These three Defender CVEs are from Microsoft’s May 2026 release and reach devices through the Defender engine and platform channel. For comparison, here is what the June 2026 Windows client update that followed actually carried, counted from Microsoft’s own June security update data:
106
CVEs in June’s Windows 11 cumulative, KB5094126
18
Of those, rated Critical
2
June’s own Defender CVEs, both Important and neither exploited
Admin Action Checklist
- Immediately: Run
Get-MpComputerStatuson representative devices. Confirm engine version is 1.1.26040.8 or later and platform is 4.18.26040.7 or later - Fleet-wide: Use the advanced hunting query above to identify all devices running an engine version below 1.1.26040.8
- If using Microsoft Update / Windows Update for Business: Devices should already be receiving the updated engine automatically — verify via device inventory
- If using manual Defender updates: Download and deploy the current Defender engine and platform update from the Microsoft Update Catalog immediately
- Zero-day context: If you have any indication of compromise on devices in your estate, prioritise those devices for immediate engine update and investigate using Defender for Endpoint live response
- RCE fix verification: Confirm engine version is at least 1.1.26040.8 to ensure the Critical CVE-2026-45584 RCE vulnerability is also patched