Windows Defender Privilege Escalation Active Exploitation | MSSP Advisory

Microsoft disclosed two actively exploited vulnerabilities in Windows Defender, including CVE-2026-41091, a privilege escalation flaw rated 7.8 CVSS that allows attackers to gain SYSTEM privileges through improper link resolution. A second denial-of-service vulnerability is also under active exploitation but lacks specific details in the disclosure.

Your RMM agents and remote access tools rely on Defender running properly on every endpoint you manage, and compromised SYSTEM privileges means attackers can disable your security stack entirely. Every client running Windows has Defender deployed by default, and active exploitation means this is happening right now across your client base.