CVE-2026-41091

Think of Microsoft Defender as the security guard on your computer. This vulnerability is like the guard taking a shortcut through a “linked” file path before checking it properly, which can let a person with access to the machine use that mistake to get more control than they should. The key point is that it targets local privilege—meaning it’s about what an attacker can do on the device after they’ve already gotten in.

This matters to you if you use or manage devices that run Microsoft Defender, specifically Microsoft Malware Protection Engine / microsoft malware protection engine. It’s most relevant for small businesses that rely on Windows endpoints and security tools without tight control over who can run code on the devices. The risk is higher because attackers are already exploiting it (known exploited in the wild).

Treat this as RED: act now. The reason is that it is already being exploited in the wild (CISA KEV), and reporting says exploitation is occurring in real attacks. Even though a public exploit is not available, attackers and named groups can still use other means, so waiting increases your chance of being targeted.