Back to the CVE list
CVE-2026-41091 CISA KEV · Actively exploited

Microsoft Defender Elevation of Privilege Vulnerability

CVSS score

7.8

EPSS probability

%0.4

Risk score

0.1

Published

5 mo ago

OverviewPublic Exploits (4)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
0xBlackash/CVE-2026-41091
GitHub

CVE-2026-41091 (★1)

Public PoCSource updated: 22.05.2026 05:49:38
G
ridhinva/defender-vulnerability-scanner
GitHub

CVE-2026-41091 / CVE-2026-45498 Microsoft Defender vulnerability scanner (★0)

Public PoCSource updated: 23.05.2026 08:46:26
G
tc4dy/CVE-2026-41091-PoC-Exploit
GitHub

🔥 CVE-2026-41091 SolarFlare | Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM via Cloud Files API + NTFS junction trickery. Forces Defender to write malicious payloads to System32 with SYSTEM rights. ⚠️ Actively exploited in wild. CVSS 7.8. Patch: Defender Engine 1.1.26040.8. 🛡️ Educational PoC only. (★0)

Public PoCSource updated: 20.06.2026 21:08:33
G
s4m98/RedSun-
GitHub

Windwos Zero Day Local PrivESc Exploit (CVE-2026-41091) (★0)

Public PoCSource updated: 09.08.2026 20:27:48

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-41091"