EUVD-2026-31101
GHSA-h776-j9jw-992p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv local shell
-
DeliveryPlant junction in Defender-scanned path
-
ExploitTrigger or await Defender engine access
-
ExecutionEngine follows link as SYSTEM
-
PersistArbitrary write/delete on protected target
-
ImpactExecute payload with SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Attacker must already have local, interactive code execution on the target Windows host as a low-privileged but authenticated user (CVSS PR:L, AV:L), with the ability to create filesystem reparse points (junctions or symlinks) in a directory that the Microsoft Defender Malware Protection Engine subsequently accesses with elevated privileges - typically achievable in user-writable locations such as %TEMP% or %ProgramData% without requiring SeCreateSymbolicLinkPrivilege when using NTFS junctions. Exploitation requires Microsoft Defender (or another product bundling the Malware Protection Engine) to be installed and actively scanning, and likely involves winning a race against the engine's file-access sequence; no user interaction is required (UI:N). Limiting factors: remote, unauthenticated, or guest-accessible scenarios are out of scope, and hosts where Defender is disabled or replaced by a third-party AV are not exploitable via this path. |
| Impact | The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-complexity, authenticated path with no user interaction and high impact across CIA - a classic SYSTEM-level local privilege escalation profile. SSVC-style assessment: exploitation status is 'none' (no KEV, no public POC observed in the provided sources), automatable is likely 'no' (link-following races typically require local foothold and timing), and technical impact is 'total' on the affected host. EPSS data was not provided, but for a freshly disclosed Microsoft LPE without public POC, real-world probability is typically low in the near term; risk rises sharply if a POC is published, because Defender is on virtually every Windows endpoint. This is a meaningful patch-now item on workstations and multi-user/RDP servers where untrusted local users exist, but it is not a remote/internet-facing emergency - prioritize behind any remote-unauth criticals on the same patch cycle. |
| Exploit ScenarioDerived | An attacker with a standard user shell on a Windows host plants a junction or symbolic link inside a directory that Microsoft Defender's engine subsequently touches during scanning, quarantine, or remediation, causing the SYSTEM-privileged engine to follow the link and write to, replace, or delete a file the user otherwise could not modify. The attacker leverages that arbitrary-write/delete primitive to drop or overwrite a binary or configuration loaded by a privileged process, gaining SYSTEM execution. No public exploit is identified at time of analysis, but link-following LPEs against AV engines are a well-trodden technique class. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 20, 2026
Local privilege escalation in Microsoft Defender (Malware Protection Engine) enables an authenticated low-privileged attacker to elevate to SYSTEM by abusing improper link resolution (CWE-59) before file access. The flaw scores CVSS 7.8 with high impact to confidentiality, integrity, and availability, and no public exploit is identified at time of analysis. Microsoft has released a patch via MSRC, and there is no current CISA KEV listing or EPSS signal indicating active mass exploitation.
RemediationAI
Patch available per vendor advisory - apply the Microsoft Malware Protection Engine update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091; the engine normally updates automatically within 48 hours via Microsoft Update / Defender definition channels, so verify that automatic engine updates are enabled and confirm the post-patch engine version on managed endpoints via Get-MpComputerStatus (AMEngineVersion) or your EDR/MDM inventory. In environments where automatic updates are blocked, push the engine update through WSUS, SCCM, Intune, or your standard Windows patching pipeline and confirm rollout. Until the updated engine is confirmed deployed, compensating controls are limited because Defender's scan paths are not user-configurable; you can reduce exposure on multi-user systems by restricting interactive logon to trusted users and tightening permissions on world-writable directories that Defender scans (e.g., %TEMP%, %ProgramData%) to inhibit junction/symlink planting, with the trade-off of potential breakage for legitimate software that writes there. Do not disable Defender as a workaround, as that removes baseline protection against far more prevalent threats.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Microsoft Malware Protection Engine (mpengine) is the core scanning component shared across Defender Antivirus, Microsoft Security Essentials, and related Microsoft endpoint security products on Windows. CWE-59 (Improper Link Resolution Before File Access, or 'link following') means the engine performs a privileged file operation against a path without first verifying that the path does not traverse a symbolic link, junction, or hardlink controlled by a lower-privileged user. Because the engine runs with elevated privileges (typically SYSTEM) when scanning, writing, quarantining, or remediating files, an attacker who can plant a junction or symlink in a directory the engine touches can redirect that privileged file I/O to a target the attacker otherwise could not modify, yielding privilege escalation on the local host.
Know when Microsoft Malware Protection Engine gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
1DescriptionCVE.org
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
Articles & Coverage 2
Executive ViewAI
Microsoft Defender's Malware Protection Engine vulnerability (CVE-2026-41091) enables local privilege escalation that allows low-privileged authenticated users to gain SYSTEM-level access through improper file link handling. This directly impacts Windows infrastructure, as compromised user accounts or insider threats could exploit this flaw to bypass security controls and obtain complete system access. Organizations must prioritize immediate remediation to prevent unauthorized access and data exfiltration across multi-user environments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Elevation of privilege in the Microsoft Malware Protection Engine (mpengine) - the scanning core shared by Microsoft Def
Remote code execution in Microsoft Defender (Microsoft Malware Protection Engine) enables unauthenticated network-based
Local code execution in Microsoft Defender (Microsoft Malware Protection Engine) allows an unauthorized attacker to run
Local code execution in Microsoft Defender's Malware Protection Engine (mpengine) arises from an integer underflow (CWE-
Elevation of privilege in the Microsoft Malware Protection Engine (Microsoft Defender), publicly named 'ShieldBreak', al
Exploit-DB