Microsoft Defender Is Being Used Against You: Two Zero-Days Hit Windows Security's Last Line
Active exploitation of a privilege escalation flaw and a denial-of-service vulnerability in Microsoft Defender puts hundreds of millions of Windows systems squarely in attackers' crosshairs.
Written by OutOfToken AI
May 24, 2026 · 4 min read · Synthesized from reporting by The Hacker News · How this works
Microsoft has confirmed that two vulnerabilities inside Microsoft Defender — the security tool trusted to protect the vast majority of Windows installations worldwide — are being actively exploited in the wild. The more severe of the two, tracked as CVE-2026-41091 and carrying a CVSS score of 7.8, can hand an attacker full SYSTEM-level privileges on a compromised machine. The second flaw enables denial-of-service conditions capable of neutralising Defender entirely, leaving systems exposed and blind.
The Mechanics of CVE-2026-41091
At the core of CVE-2026-41091 is an improper link resolution vulnerability — a class of flaw formally described as 'link following' — triggered during file access operations within Defender. When a process with standard user privileges creates a crafted symbolic or hard link, Defender's file handling routines follow that link without adequately verifying its destination, allowing code execution or file operations in the context of the SYSTEM account. Achieving SYSTEM privileges is effectively game over for any machine: attackers can disable security controls, exfiltrate credentials stored in memory, install persistent backdoors, and pivot laterally across enterprise networks. The 7.8 CVSS rating reflects high impact across confidentiality, integrity, and availability, though the attack requires local access — a bar that drops significantly when paired with a social engineering campaign or an initial-access broker.
A Denial-of-Service Flaw That Blinds Your Defences
The second vulnerability compounds the threat considerably. A denial-of-service flaw in Defender — details on its specific CVE identifier are pending full disclosure — can be triggered to crash or disable the antimalware service process entirely. In isolation, a DoS against an endpoint protection tool sounds manageable. In combination with a privilege escalation zero-day, it forms a surgical two-stage attack chain: first blind the defender, then elevate privileges undetected. Security researchers have noted this pairing is consistent with tactics used by sophisticated threat actors targeting enterprise environments, where disabling endpoint detection before deploying ransomware or espionage tooling has become standard operating procedure.
""Improper link resolution before file access in Microsoft Defender allows an attacker to elevate privileges to SYSTEM level" — Microsoft Security Advisory on CVE-2026-41091, CVSS 7.8"
Who Is at Risk and What Needs to Happen Now
Microsoft Defender ships as the default security solution across virtually every modern Windows installation, meaning the attack surface here is measured in the hundreds of millions of endpoints — home users, small businesses, and large enterprises alike. Organisations relying solely on Defender without additional layered controls face particularly acute exposure. Microsoft has pushed security updates addressing both vulnerabilities, and the company's guidance is unambiguous: patch immediately. Windows Update should deliver the fixes automatically for most consumer and enterprise configurations, but IT administrators should manually verify that Defender's definition and engine updates have propagated across managed fleets. The CVE identifier's 2026 year designation is unusual and should be cross-referenced against the Microsoft Security Update Guide and NIST's National Vulnerability Database to confirm versioning details prior to internal incident response planning.
The active exploitation of vulnerabilities inside Microsoft Defender is a pointed reminder that security tooling itself represents a high-value target — attackers understand that compromising the protector neutralises everything behind it. As threat actors grow more sophisticated in chaining local privilege escalation with defence-evasion techniques, the industry's reliance on any single security layer becomes an increasingly dangerous bet. Microsoft's speed in issuing patches matters less than enterprises' speed in deploying them. In a threat landscape where zero-days are weaponised within hours of discovery, the window between disclosure and mass exploitation has effectively closed.
Editorial Note
The Hacker News is a reputable cybersecurity news source with established credibility. Microsoft regularly discloses security vulnerabilities through official advisories, and active exploitation of Defender flaws is plausible given the software's widespread use. However, the CVE identifier format (CVE-2026-41091) uses a future year which is unusual and warrants verification against official Microsoft Security Update Guide or NIST CVE databases.
Claim Tracker
AI-assessed
The CVE number format (2026) is future-dated and appears fictional or erroneous; requires verification of actual CVE database
Article claims active exploitation but provides no source attribution, timeline, or evidence of in-the-wild attacks
Technical description provided but cannot be verified without official Microsoft security advisory or CVE database entry
Unsupported claim about market dominance; no statistics or sources provided
Plausible based on described vulnerability class but unconfirmed; no proof-of-concept or exploitation reports cited
Ask AI about this story
// discussion
sign in to join the discussion