Microsoft Defender Privilege Escalation LPE (CVE-2026-41091) | MSSP Advisory

CISA added CVE-2026-41091 to the Known Exploited Vulnerabilities catalog, flagging a privilege escalation flaw in Microsoft Defender that lets authorized attackers gain local admin rights. Your RMM agents and client endpoints running Defender are exposed to attackers who already have initial access turning that foothold into full system control.

Your management stack likely runs Defender across dozens of client networks, creating a pathway for attackers to escalate from limited user access to domain admin privileges. Client environments expect you to flag critical security tool vulnerabilities before they become breach vectors, and missing this creates both technical risk and contract liability.