CVE-2026-41091KEV · OVERDUECWE-59

Microsoft Defender Elevation of Privilege Vulnerability

High · published May 20, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 37.5th percentile for exploit probability.

143

days past CISA
deadline

CVSS v3.1

7.8

EPSS

Percentile

37.5

In the wild

Confirmed

What it is

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.

The record

Technical detail

CVSS v3.1: 7.8 · HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0: Not supplied
EPSS: 0.00443 · 37.5th percentile
Weakness: CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published: 2026-05-20T13:09Z
KEV added: 2026-05-20 · due 2026-06-03

EPSS history

Timeline