Privilege Escalation in Microsoft Defender (CVE‑2026‑41091) Allows Local Privilege Elevation
What It Is – Microsoft Defender contains a link‑following flaw that lets an authorized attacker elevate privileges on the local host. The issue is tracked as CVE‑2026‑41091 and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
Exploitability – The vulnerability can be triggered by a malicious link processed by Defender; a proof‑of‑concept exists and the CVSS score is rated 7.8 (High).
Affected Products – Microsoft Defender for Endpoint on Windows 10/11 and Windows Server editions that include the vulnerable component.
Why It Matters for Trust & Control Assurance
- Tests the privilege‑management control objective: organizations must enforce least‑privilege, monitor privileged actions, and maintain evidence of compliance.
- Highlights the importance of continuous patch management as part of an auditable control‑assurance program.
- Demonstrates that endpoint security tools themselves must be subject to the same control monitoring that they enforce for other assets.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2026‑41091 immediately across all managed endpoints.
- Verify patch rollout with automated compliance tooling and retain evidence of successful installation.
- Review privileged‑access policies; ensure that any accounts capable of invoking Defender are limited to the minimum required rights.
- Enable logging of privilege‑elevation events and integrate them into your SIEM for continuous monitoring.
- Conduct a post‑patch audit to confirm that the control objective of “privileged access management” remains satisfied.
Source: CISA KEV – CVE‑2026‑41091