Microsoft Defender Vulnerabilities Actively Exploited in the Wild

Microsoft disclosed two actively exploited vulnerabilities in Microsoft Defender. CVE-2026-41091 (CVSS 7.8) abuses improper link resolution before file access (“link following”) to escalate privileges to SYSTEM level. A denial-of-service companion flaw was patched alongside it. Both are confirmed exploited in the wild per Microsoft’s threat intelligence.

Defender updates are distributed automatically via Windows Update on most configurations, but environments with deferred update cycles or isolated endpoints should verify patch status manually. Prioritize systems with reduced update cadence — air-gapped servers, legacy workstations — as the exploit pathway appears low-complexity.