CVE-2026-41091

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-41091 7.8

Microsoft · Defender · Added 2026-05-20 · Published 2026-05-20

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityMicrosoft Defender Link Following Vulnerability

VendorMicrosoft

ProductDefender

Date added2026-05-20

Due date2026-06-03

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-59

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.

NVD: Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-28 09:41 UTC

Searches5

Component defaultyes

Sources https://blog.calif.io/p/redsun-exploiting-windows-defenders
https://nvd.nist.gov/vuln/detail/CVE-2026-41091
https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day
https://www.sentinelone.com/vulnerability-database/cve-2026-41091/
https://www.picussecurity.com/resource/blog/rogueplanet-anatomy-of-the-nightmare-eclipse-microsoft-defender-zero-day
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091
https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit
https://www.helpnetsecurity.com/2026/05/21/microsoft-defender-vulnerabilities-cve-2026-41091-cve-2026-45498/
https://github.com/0xBlackash/CVE-2026-41091

Hunting hypothesis agent

Hunt Sysmon for TieringEngineService.exe bait in %TEMP%\SF-*, then batch oplock, CfRegisterSyncRoot SolarFlareProvider, NTFS junction to System32, and CoCreateInstance Storage Tiers Management CLSID {50d185b9}; Sysmon EID 1/15/11 needed.

Research details

ComponentMalware Protection Engine - mpengine.dll (cloud file remediation/rollback path via TieringEngineService.exe)

PreconditionsThe attacker must have local low-privileged access (authenticated standard user) to a Windows system running Microsoft Defender with real-time protection enabled (Malware Protection Engine <= 1.1.26030.3008). Defender's real-time scanning must be active so it detects a malicious file and triggers its remediation workflow. The attacker writes a reversed EICAR string to a bait file named TieringEngineService.exe in a temp directory, then uses batch oplocks (FSCTL_REQUEST_BATCH_OPLOCK) combined with NTFS junctions (IO_REPARSE_TAG_MOUNT_POINT) to redirect Defender's SYSTEM-level file write to C:\Windows\System32. The Cloud Files API must be available for CfRegisterSyncRoot/CfCreatePlaceholders. No network access required; entirely local. agent

DeliveryLocal C++ exploit (RedSun/SolarFlare) by low-privileged user: writes reversed EICAR string to TieringEngineService.exe bait in %TEMP%\SF-XXXX, polls \Device\HarddiskVolumeShadowCopy* via NtQueryDirectoryObject for VSS detection, freezes MsMpEng.exe with FSCTL_REQUEST_BATCH_OPLOCK, swaps bait for Cloud Files placeholder via CfRegisterSyncRoot (provider name SolarFlareProvider) and CfCreatePlaceholders, redirects working directory to C:\Windows\System32 via NTFS junction (IO_REPARSE_TAG_MOUNT_POINT), then activates Storage Tiers Management COM object (CoCreateInstance CLSID {50d185b9-fff3-4656-92c7-e4018da4361d}) to launch planted binary as NT AUTHORITY\SYSTEM.

Public PoCyes

PoC URLs https://github.com/0xBlackash/CVE-2026-41091
https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit Third-party repos; verify before use.

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091

Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.8). The RedSun exploit (tc4dy/CVE-2026-41091-PoC-Exploit) uses batch oplocks to turn a non-deterministic race into a deterministic timing window — the attack is reliable, not probabilistic. Six-stage chain: EICAR trigger, VSS detection via NtQueryDirectoryObject polling \Device for HarddiskVolumeShadowCopy*, first batch oplock to freeze MsMpEng.exe, Cloud Files placeholder swap (CfRegisterSyncRoot with provider name SolarFlareProvider, zero hydration callbacks), NTFS junction (IO_REPARSE_TAG_MOUNT_POINT) to C:\Windows\System32, and COM activation of Storage Tiers Management (CLSID {50d185b9-fff3-4656-92c7-e4018da4361d}). Requires local low-privileged access with Defender real-time protection enabled; Malware Protection Engine version <= 1.1.26030.3008 affected.

SummaryPrivilege escalation vulnerability (CVSS 7.8) in Microsoft Defender's Malware Protection Engine (mpengine.dll) exploited in the wild as RedSun. When Defender detects a malicious file with a Cloud Files placeholder tag, it rewrites the file to its original location instead of quarantining it. A low-privileged attacker exploits this by placing batch oplocks and an NTFS junction to redirect Defender's SYSTEM-privileged file write into C:\Windows\System32, then activates a COM service to execute the planted binary as NT AUTHORITY\SYSTEM. Patched in engine version 1.1.26040.8.

Tia coverage

First reported2026-05-21

First exploit report2026-05-21

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

microsoft-defender-zero-days-cve-2026-41091-cve-2026-45498-activ

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.