Operating system securityHigh severity

SECURITY GUIDE

Security Control Bypass in Microsoft Defender (CVE-2026-41091)

Understand how symlink and file handle race conditions in endpoint security scanners allow defense evasion and privilege escalation.

Areas to considerMicrosoft Defender AntivirusWindows Security CenterEndpoint Detection & Response (EDR)
01

THE CONTEXT

What to understand

CVE-2026-41091 is a security feature bypass and local privilege escalation vulnerability in Microsoft Defender. The vulnerability stems from improper handling of filesystem junction points and symbolic links by the antimalware service when cleaning quarantined items. A local attacker can create a race condition targeting quarantine cleanup routines, causing the service to overwrite arbitrary system files or disable security enforcement modules.

02

HIGH-LEVEL CONCEPT

How the risk can develop

This is a conceptual overview, not a procedure for reproducing an attack.

  1. A local attacker plants a benign test signature inside a temporary folder with crafted junction points.
  2. The Defender engine detects the file and triggers an automated quarantine and deletion workflow.
  3. Before deletion occurs, the attacker redirects the folder junction to a protected system file location.
  4. The antivirus engine follows the manipulated link and alters the target system file under SYSTEM authority, disabling protection.
03

WHY IT MATTERS

Potential impact

Disabling of real-time antivirus protection, arbitrary file modification with SYSTEM privileges, and bypass of endpoint detection defenses.

04

BE AWARE

Signals to monitor

  • High-frequency creation and deletion of NTFS junctions or symlinks within temporary directories.
  • Defender event logs (Event ID 5001 or 5007) indicating sudden changes in real-time protection state.
  • System integrity alerts warning of unauthorized modifications to security service DLLs or configuration keys.
05

PUT DEFENSE FIRST

Recommended defenses

  1. 01Deploy the monthly Microsoft Defender Platform and Engine updates via Windows Update or WSUS.
  2. 02Enforce Tamper Protection across all Windows endpoints to prevent unauthorized security state changes.
  3. 03Restrict standard users from creating symlinks and junctions pointing to sensitive system directories.
  4. 04Monitor endpoint logs for rapid file-link swapping behavior typical of junction abuse.