Two Microsoft Defender vulnerabilities are being actively exploited — one that hands attackers SYSTEM privileges by turning the Malware Protection Engine into a symlink-following privilege escalation tool, and one that triggers denial-of-service against the Antimalware Platform. CISA added both to its Known Exploited Vulnerabilities catalog on May 20, 2026, triggering mandatory remediation timelines for U.S. federal civilian agencies.
CVE-2026-41091: Defender Malware Protection Engine as a Privilege Escalation Vector
CVE-2026-41091 affects Microsoft Malware Protection Engine version 1.1.26030.3008 and earlier. The flaw is classified under CWE-59 — “improper link resolution before file access” — a vulnerability class in which software follows a symbolic link created by an attacker to operate on an unintended file target. Because the Malware Protection Engine runs with SYSTEM-level process trust during file scanning operations, an attacker who places a symbolic link in a location the engine monitors can redirect file access operations to an attacker-controlled path. The result is a local privilege escalation from any standard user account to SYSTEM, which represents the highest privilege tier on Windows.
The attack requires local access but no administrative rights. Any standard user on an unpatched Windows system running the affected Malware Protection Engine version can trigger the symlink resolution path and gain full SYSTEM-level control. Microsoft released the fixed engine version — 1.1.26040.8 — which deploys automatically through Windows Update on most managed devices.
How CVE-2026-41091’s Symlink Follow Grants SYSTEM Privileges via Microsoft Defender
The attack mechanism exploits a structural feature of endpoint security agents: they operate continuously in the background at elevated privilege levels to inspect files and processes. CVE-2026-41091 redirects that inspection behavior against the attacker’s chosen target. When the Malware Protection Engine follows the planted symbolic link, it performs an action at SYSTEM privilege on the attacker’s chosen path, completing the privilege escalation without triggering conventional user-account-control checks.
Administrators should verify that the engine update to version 1.1.26040.8 has applied through Windows Security settings. In environments subject to update deferral policies, network restrictions, or periodic disconnection — including operational technology networks and air-gapped systems that occasionally receive update packages — manual verification is necessary rather than assumed.
CVE-2026-45498: Denial-of-Service in Defender Antimalware Platform Disables Endpoint Protection
CVE-2026-45498 affects Defender Antimalware Platform version 4.18.26030.3011 and earlier, as well as System Center Endpoint Protection and Security Essentials variants. Exploitation triggers denial-of-service conditions on unpatched Windows devices, disrupting the endpoint protection layer at scale. The fixed Antimalware Platform version — 4.18.26040.7 — also deploys through Windows Update automatically.
The operational pairing of a denial-of-service and a privilege escalation in the same endpoint security agent creates a compound attack scenario: disabling protection via CVE-2026-45498 before exploiting additional vulnerabilities removes the detection layer while CVE-2026-41091 provides the escalation mechanism. Both vulnerabilities have been confirmed as actively exploited, meaning adversaries have already operationalized at least one of the two attack paths.
CISA KEV Mandate and the Defender-as-Attack-Surface Problem for Enterprise Windows
CISA’s Known Exploited Vulnerabilities designation mandates that U.S. federal civilian executive branch agencies remediate both CVEs by the applicable KEV deadline. The active exploitation classification distinguishes these from routine monthly Patch Tuesday items — it indicates adversaries are already incorporating the vulnerabilities into attack tooling in live operations.
For non-federal organizations, the KEV listing serves as a signal that both patches warrant emergency-tier prioritization rather than standard patching cycles. The automatic Windows Update delivery mechanism is the primary remediation path, but organizations with managed update environments should audit deployment status rather than rely on default update behavior. Given that both patches are already in the Windows Update pipeline, verification of version numbers in Windows Security settings is the fastest way to confirm exposure status — Malware Protection Engine 1.1.26040.8 and Antimalware Platform 4.18.26040.7 represent the remediated state for each respective CVE.
