[ ACTIVELY EXPLOITED ] CVSS 7.8 HIGH LOCAL PRIVILEGE ESCALATION CWE-59 LINK FOLLOWING
| CVSS Score 7.8 (High) | Severity High | Disclosed May 19, 2026 | CISA KEV Deadline June 3, 2026 |
Think you work in an office building with a security guard (Microsoft Defender) who has a master key to every room. You slip a fake sign on a broom cupboard that says “Server Room”. The guard dutifully unlocks the actual server room on your behalf — because they followed your sign without checking where it really pointed.
That fake sign is a symbolic link: a pointer on the filesystem that redirects one path to another. CVE-2026-41091 exists because Defender’s engine follows these pointers without verifying the destination before operating on them with full NT AUTHORITY\SYSTEM privileges.
Technical Root Cause
The bug lives in the Microsoft Malware Protection Engine (MMPE), classified under CWE-59: Improper Link Resolution Before File Access (“link following”). During a file scan, MMPE resolves a path and then performs privileged file operations — but it does not validate whether the path was redirected between the time it checked and the time it acted. This is a classic TOCTOU (Time-of-Check / Time-of-Use) race condition.
| Attacker creates: C:\Users\lowpriv\AppData\scan_target -> symlink Symlink target: C:\Windows\System32\config\SAM (protected system file) Defender scans C:\Users\lowpriv\AppData\scan_target resolves path OK follows symlink WITHOUT re-validating destination VULNERABLE operates on SAM with NT AUTHORITY\SYSTEM FULL TAKEOVER |
Affected versions: MMPE prior to v1.1.26040.8 and Antimalware Platform prior to v4.18.26040.7.
Step-by-Step Attack Chain
| 1 | Initial Foothold The attacker already has low-privilege local access — gained via phishing, a drive-by exploit, or a stolen credential. No admin rights are required at this stage. |
| 2 | Plant the Malicious Symlink Using a standard user account, the attacker creates a symlink in a directory Defender will scan — pointing to a sensitive target like the SAM hive, LSASS memory dump path, or a critical system binary. |
| 3 | Trigger a Defender Scan The attacker waits for a scheduled scan, or triggers one by dropping a known EICAR test string in the directory. Defender’s engine wakes up and begins processing the planted path. |
| 4 | Engine Follows the Link as SYSTEM MMPE resolves the symlink without re-validating the target. It accesses — or modifies — the pointed-to file using its own NT AUTHORITY\SYSTEM privilege context. |
| 5 | Escalate to SYSTEM The attacker reads extracted credential hashes from the SAM file, injects a backdoor DLL into a SYSTEM-owned path, or overwrites a privileged binary — achieving full system compromise. |
Real-World Exploitation Scenarios
| Scenario 1: Corporate Endpoint Takeover An attacker sends a phishing email to a helpdesk employee. The employee runs the attachment, giving the attacker a low-privilege shell. The attacker drops the “RedSun” PoC (published April 15 by researcher Nightmare Eclipse), plants the symlink, and waits for Defender’s next scheduled scan — typically within minutes. Result: full SYSTEM shell on a corporate laptop, with access to cached domain credentials in LSASS. |
| Scenario 2: Shared / Kiosk Environment On a shared machine (library terminal, hotel business center), a guest user account runs the exploit. Because Defender is always active and scanning, no special timing is needed. Once at SYSTEM, the attacker plants a persistent backdoor that survives reboots and user account switches. |
| Scenario 3: Chained with CVE-2026-45498 (Defender DoS) Huntress incident responders observed attackers combining CVE-2026-41091 (LPE) with CVE-2026-45498 (DoS — disabling Defender) and the earlier BlueHammer (CVE-2026-33825) flaw in a single intrusion. The DoS component silenced Defender’s alerting before the privilege escalation ran, significantly reducing detection chances. |
| The “RedSun” PoC exploit was publicly released on April 15, 2026 by a researcher going by Nightmare Eclipse — over a month before Microsoft’s May 19 patch. CISA confirmed active in-the-wild exploitation and mandated that US federal civilian agencies patch by June 3, 2026. |
What To Do Right Now
| Good news: most users are already protected. Microsoft Defender updates its engine automatically in the background. If automatic updates are enabled, you likely received the fix (MMPE v1.1.26040.8) within hours of its release. |
To verify your engine version, open PowerShell and run:
| Get-MpComputerStatus | Select-Object AMEngineVersion, AMProductVersion |
You need AMEngineVersion ≥ 1.1.26040.8 and AMProductVersion ≥ 4.18.26040.7.
If you manage an air-gapped or tightly controlled environment where auto-updates are blocked, manually deploy the engine update via WSUS, MECM, or Intune immediately. This vulnerability also affects Microsoft Security Essentials and System Center Endpoint Protection running the same engine.
Detection Guidance
Hunt for unusual symlink creation in user-writable directories:
| Get-WinEvent -LogName Microsoft-Windows-Windows Defender/Operational | Where-Object {$_.Message -like “*symbolic*”} |
Also monitor for:
- Low-privileged processes creating junction points or symlinks in temp/appdata directories
- MMPE accessing SAM, SECURITY, or SYSTEM registry hive files outside of normal backup operations
- Unexpected SYSTEM-level file writes to directories owned by standard users
- Presence of EICAR test files dropped by non-admin accounts (scan triggering technique)
Affected Products
| Product | Vulnerable version | Fixed version |
| Microsoft Defender (MMPE) | < 1.1.26040.8 | 1.1.26040.8 |
| Microsoft Defender Antimalware Platform | < 4.18.26040.7 | 4.18.26040.7 |
| Microsoft Security Essentials | Same MMPE | 1.1.26040.8 |
| System Center Endpoint Protection | Same MMPE | 1.1.26040.8 |
Proactive Defence with FileDNA
Patching Defender is the essential first step, but it addresses the vulnerability after the engine already exists on the endpoint. A complementary layer of defence — one that stops a malicious shortcut file from ever reaching the scan queue in the first place — is provided by FileDNA, a file intelligence and sanitization platform built around Content Disarm and Reconstruction (CDR) principles.
Where CVE-2026-41091 is rooted in the LNK (Windows shortcut) and symlink file format, FileDNA operates at the file structure level — parsing each incoming file against the known-good specification of its declared type before it is written to disk or handed to any security engine for scanning. For shortcut files specifically, FileDNA:
- Inspects the Shell Link Binary structure: Every LNK file is parsed field-by-field against the Microsoft Shell Link Binary Format (MS-SHLLINK) specification. Any field that deviates from the standard — including unexpected target path entries, environment variable blocks, or extra data sections commonly abused to embed symlink redirections — is flagged and stripped before execution.
- Resolves and validates link targets at ingest: FileDNA resolves the declared target path at the point of file ingestion, checking whether it points outside an expected boundary (e.g. user-writable directories redirecting to system paths such as C:\Windows\System32\config\SAM). Paths that traverse privilege boundaries are blocked or neutralised outright.
- Rebuilds a clean, functionally equivalent copy: Rather than quarantining the original file, FileDNA reconstructs a sanitised version containing only the safe, specification-compliant elements — preserving usability while eliminating the attack surface. The original is retained in an isolated store for forensic review.
- Operates pre-execution, not post-detection: Because FileDNA acts at the point of file ingest (email gateway, web download, USB transfer, or network share), the sanitised shortcut reaches the endpoint with its malicious redirection already removed. Defender never encounters the weaponised symlink, so the CWE-59 code path in MMPE is never triggered — even on unpatched systems.
This makes FileDNA particularly valuable in environments where automatic Defender engine updates cannot be guaranteed — air-gapped networks, OT/ICS environments, or managed endpoints where engine rollouts are staged over days or weeks. During that window of exposure, FileDNA’s pre-execution sanitization acts as an independent, detection-agnostic control that does not rely on signature databases or behavioural heuristics. It removes the malicious structure because it is structurally non-conformant, not because it matches a known threat pattern — making it equally effective against novel variants of this attack class and future zero-days built on the same CWE-59 weakness