Microsoft Defender Malware Protection Engine Privilege Escalation (CVE-2026-41091) | MSSP Advisory

Two Microsoft Defender vulnerabilities are being exploited in the wild, with CISA adding them to its Known Exploited Vulnerabilities catalog. CVE-2026-41091 allows attackers to escalate privileges to SYSTEM level through improper link resolution in the Malware Protection Engine, while CVE-2026-45498 enables denial-of-service attacks. Both vulnerabilities target the core security engine that most Windows environments depend on for endpoint protection.

Your RMM agents and remote access tools run with elevated privileges on client systems protected by Defender, making them prime targets if an attacker gains SYSTEM access through these vulnerabilities. Every client running Windows Defender becomes a potential entry point for lateral movement, and you need to advise them immediately since these are confirmed active exploits, not theoretical risks.