Improper link resolution before file access

CVE-2026-41091 is a local privilege escalation in the Microsoft Malware Protection Engine used by Microsoft Defender. The bug is a classic link-following issue: the engine can be tricked into resolving a link and touching the wrong file path under elevated context, letting a low-privileged local user pivot to SYSTEM. NVD lists the affected range as Microsoft Malware Protection Engine versions 1.1.26030.3008 through <1.1.26040.8, with 1.1.26040.8 as the first fixed engine build.

Microsoft’s HIGH label is basically right, but the reason is not the CVSS impact math alone. In a vacuum this should get downward pressure because it is AV:L/PR:L and therefore requires an attacker to already have code execution or an authenticated foothold on the endpoint; in the real world, the KEV listing and active exploitation pull it back up because Defender is everywhere and SYSTEM-level post-exploitation on a commodity Windows host is exactly how small intrusions become domain-wide problems.

Why this verdict

• Active exploitation overrides complacency: KEV-listed plus Microsoft-reported exploitation means attackers are already converting this bug into operational value.
• Ubiquitous deployment amplifies it: Defender is present on a huge share of Windows endpoints, so a local LPE in the antimalware engine has estate-wide relevance even without network exposure.
• Friction audit says HIGH, not CRITICAL: the chain requires AV:L and PR:L, which implies prior compromise or a valid low-priv account on the box; that sharply narrows reachable population versus unauthenticated remote flaws.
• Modern controls should stop earlier stages, not this stage: email security, browser isolation, MFA, and NGFWs do nothing once malware is already executing as a standard user on the endpoint.
• Blast radius depends on host role: SYSTEM on a developer laptop, admin workstation, or jump server is materially worse than SYSTEM on a disposable kiosk, so enterprise risk is driven by where the foothold lands.

Why not higher?

It is not unauthenticated remote, not wormable, and not a pre-auth server-side bug. The attacker position requirement is the real brake here: needing local low-privilege execution means this is a second-stage exploit, so the addressable population is every *compromised* Windows endpoint, not every reachable Windows endpoint.

Why not lower?

Dropping this to MEDIUM would ignore two real-world amplifiers: KEV status and the fact that Microsoft Defender is everywhere. A post-compromise SYSTEM escalator that is actively used in the wild is exactly the kind of bug that lets routine endpoint infections punch above their weight.

1. Verify engine currency now — Audit AMEngineVersion and isolate any host below 1.1.26040.8. Because this is a HIGH verdict with active exploitation evidence, do not wait for the normal 30-day window; verify and enforce the update immediately, within hours.
2. Hunt for low-priv-to-SYSTEM transitions — Prioritize telemetry where a standard user context is followed by Defender service activity and then SYSTEM-level file, service, or process changes. Run this hunt immediately, within hours on high-value Windows tiers because exploit attempts may not be obvious from scanner data alone.
3. Tighten local execution paths — Reduce the number of users who can stage and run arbitrary binaries, scripts, and filesystem tricks by enforcing AppLocker/WDAC, ASR rules, and least privilege. This does not fix the bug, but it lowers exploitability while patching; for this KEV-listed case, deploy or validate these controls immediately, within hours where not already enforced.
4. Prioritize tier-zero and admin workstations — Patch validation should start with jump hosts, help-desk endpoints, developer workstations, and any device handling privileged sessions. Those systems turn a local SYSTEM bug into credential theft and lateral movement, so complete this priority sweep immediately, within hours, then finish the broader estate.

Run this on the target Windows host or through your remote management tool as a local PowerShell session: powershell.exe -ExecutionPolicy Bypass -File .\check-CVE-2026-41091.ps1. Local admin is preferred for consistent Defender status access, though many systems will return the version to standard users; the script exits 0 for PATCHED, 1 for VULNERABLE, and 2 for UNKNOWN.

# check-CVE-2026-41091.ps1

# Verifies whether Microsoft Defender AMEngineVersion is patched for CVE-2026-41091.

# Exit codes:

#   0 = PATCHED

#   1 = VULNERABLE

#   2 = UNKNOWN


param(
    [string]$FixedVersion = '1.1.26040.8'
)

function Compare-Version {
    param(
        [Parameter(Mandatory=$true)][string]$A,
        [Parameter(Mandatory=$true)][string]$B
    )

    try {
        $aParts = $A.Split('.') | ForEach-Object { [int]$_ }
        $bParts = $B.Split('.') | ForEach-Object { [int]$_ }

        $max = [Math]::Max($aParts.Count, $bParts.Count)
        for ($i = 0; $i -lt $max; $i++) {
            $aVal = if ($i -lt $aParts.Count) { $aParts[$i] } else { 0 }
            $bVal = if ($i -lt $bParts.Count) { $bParts[$i] } else { 0 }

            if ($aVal -lt $bVal) { return -1 }
            if ($aVal -gt $bVal) { return 1 }
        }
        return 0
    }
    catch {
        return $null
    }
}

try {
    $status = Get-MpComputerStatus -ErrorAction Stop
} catch {
    Write-Output 'UNKNOWN - Failed to query Defender status with Get-MpComputerStatus.'
    exit 2
}

if (-not $status) {
    Write-Output 'UNKNOWN - Defender status object was empty.'
    exit 2
}

$engineVersion = $status.AMEngineVersion
$productVersion = $status.AMProductVersion
$rtp = $status.RealTimeProtectionEnabled
$serviceEnabled = $status.AMServiceEnabled

if ([string]::IsNullOrWhiteSpace($engineVersion)) {
    Write-Output 'UNKNOWN - AMEngineVersion not available.'
    exit 2
}

$cmp = Compare-Version -A $engineVersion -B $FixedVersion
if ($null -eq $cmp) {
    Write-Output ("UNKNOWN - Could not compare versions. Detected AMEngineVersion={0}; AMProductVersion={1}; RTP={2}; ServiceEnabled={3}" -f $engineVersion, $productVersion, $rtp, $serviceEnabled)
    exit 2
}

if ($cmp -lt 0) {
    Write-Output ("VULNERABLE - AMEngineVersion {0} is older than fixed version {1}. AMProductVersion={2}; RTP={3}; ServiceEnabled={4}" -f $engineVersion, $FixedVersion, $productVersion, $rtp, $serviceEnabled)
    exit 1
}
else {
    Write-Output ("PATCHED - AMEngineVersion {0} is at or newer than fixed version {1}. AMProductVersion={2}; RTP={3}; ServiceEnabled={4}" -f $engineVersion, $FixedVersion, $productVersion, $rtp, $serviceEnabled)
    exit 0
}

Sources

1. NVD CVE-2026-41091
2. Microsoft Security Update Guide advisory
3. CISA Known Exploited Vulnerabilities catalog entry
4. BleepingComputer reporting on active exploitation
5. Help Net Security summary with affected/fixed versions
6. Microsoft Learn: Get-MpComputerStatus
7. Microsoft Learn: MSFT_MpComputerStatus class
8. FIRST EPSS documentation/API root