Page generated: 11 Nov 2026, 06:04 UTC
← Dashboard

CVE-2026-41091

UnDefend

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.

CVSS 7.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.2/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 7.8: +1.17
  • Fresh EPSS: 8.20%: +0.04

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 47 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

BleepingComputer
Press · 22 Sep 2026, 07:00 · New Windows Defender zero-day blocks Microsoft antivirus updates - BleepingComputer
Barracuda Blog
Press · 03 Sep 2026, 07:00 · Nightmare-Eclipse: six zero-days, six weeks and one big grudge - Barracuda Blog
The Hacker News
Press · 09 Jul 2026, 07:00 · Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges - The Hacker News
Sophos
Press · 11 Jun 2026, 07:00 · June Patch Tuesday smashes past 500-CVE mark - Sophos
The Hacker News
Press · 10 Jun 2026, 07:00 · Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows - The Hacker News
See all 47 source documents
Zero Day Initiative - Blog
Press · 09 Jun 2026, 18:12 · The June 2026 Security Update Review
thezdi.com
Press · 09 Jun 2026, 07:00 · The June 2026 Security Update Review - thezdi.com
Security Affairs
Press · 09 Jun 2026, 07:00 · Microsoft Releases Record-Breaking Patch Tuesday With 208 CVEs - Security Affairs
Redmondmag.com
Press · 09 Jun 2026, 07:00 · Microsoft June Patch Tuesday Breaks Records, Includes 4 Zero-Day Fixes - Redmondmag.com
SC Media
Press · 02 Jun 2026, 07:00 · Microsoft denies legal action against researchers after slamming BlueHammer publisher - SC Media
Cyber Press
Press · 01 Jun 2026, 07:00 · Microsoft Says It Won’t Sue Researchers in Nightmare-Eclipse Case - Cyber Press
Notebookcheck
Press · 01 Jun 2026, 07:00 · CISA gives Windows admins until June 3 to patch Nightmare Eclipse Defender flaws - Notebookcheck
CyberSecurityNews
Press · 01 Jun 2026, 07:00 · Microsoft Clarifies It Won't Sue Security Researchers Amid Nightmare-Eclipse Controversy - CyberSecurityNews
Cybernews
Press · 28 May 2026, 07:00 · Microsoft’s nightmare: GitLab removes rogue security researcher days after GitHub ban - Cybernews
The Register
Press · 28 May 2026, 07:00 · Disgruntled 0-day hunter 'humiliated' by Microsoft pledges 'bone shattering drop' as Redmond calls cops - The Register
Cyber Press
Press · 28 May 2026, 07:00 · Microsoft Warns Against Early Disclosure of Zero-Day Vulnerabilities - Cyber Press
The Hacker News
Press · 28 May 2026, 07:00 · Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal - The Hacker News
CyberSecurityNews
Press · 28 May 2026, 07:00 · Microsoft Warns Public Release of Zero-Day Details Before Vendor Coordination - CyberSecurityNews
Check Point Research
Press · 25 May 2026, 07:00 · 25th May – Threat Intelligence Report - Check Point Research
Notebookcheck
Press · 22 May 2026, 07:00 · Microsoft patches Defender zero-days exploited in live attacks - Notebookcheck
CyberSecurityNews
Press · 22 May 2026, 07:00 · CISA Warns of Microsoft Defender 0-Day Vulnerabilities Exploited in Attacks - CyberSecurityNews
CXO Digitalpulse
Press · 22 May 2026, 07:00 · Microsoft Warns About Two Actively Exploited Defender Vulnerabilities - CXO Digitalpulse
Cyber Daily
Press · 22 May 2026, 07:00 · Microsoft patches pair of Microsoft Defender zero-days following active exploitation - Cyber Daily
Rescana
Press · 21 May 2026, 07:00 · Microsoft Defender Zero-Day Vulnerabilities RedSun and UnDefend Actively Exploited on Windows 10, 11, and Server (April 2026 CVE Analysis) - Rescana
SQ Magazine
Press · 21 May 2026, 07:00 · Microsoft Patches Active Defender Zero Day Vulnerabilities - SQ Magazine
GBHackers News
Press · 21 May 2026, 07:00 · Microsoft Defender Zero-Day Vulnerabilities Actively Exploited in the Wild - GBHackers News
Tech Times
Press · 21 May 2026, 07:00 · Microsoft Defender Zero-Days Patched: RedSun, UnDefend Exploits Already Used in Live Intrusions - Tech Times
The Hacker News
Press · 21 May 2026, 07:00 · Microsoft Warns of Two Actively Exploited Defender Vulnerabilities - The Hacker News
CSO Online
Press · 21 May 2026, 07:00 · Microsoft patches two zero-day flaws in Defender - CSO Online
SecurityWeek
Press · 21 May 2026, 07:00 · Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days - SecurityWeek
BleepingComputer
Press · 21 May 2026, 07:00 · Microsoft warns of new Defender zero-days exploited in attacks - BleepingComputer
CyberSecurityNews
Press · 21 May 2026, 07:00 · New Microsoft Defender 0‑Days Actively Exploited in the Wild - CyberSecurityNews
Help Net Security
Press · 21 May 2026, 07:00 · Microsoft Defender vulnerabilities exploited in the wild (CVE-2026-41091, CVE-2026-45498) - Help Net Security
Forbes
Press · 21 May 2026, 07:00 · 2 New Microsoft Defender Zero-Days Exploited—Patch Now Rolling Out - Forbes
Dark Reading
Press · 21 Apr 2026, 07:00 · Exploits Turn Windows Defender Into Attacker Tool - Dark Reading
CyberSecurityNews
Press · 21 Apr 2026, 07:00 · Hackers Use Nightmare-Eclipse Tools After Compromising FortiGate SSL VPN Access - CyberSecurityNews
Petri IT Knowledgebase
Press · 20 Apr 2026, 07:00 · Attackers Exploit Windows Zero-Days to Bypass Microsoft Defender - Petri IT Knowledgebase
heise online
Press · 20 Apr 2026, 07:00 · Unpatched Windows zero-days RedSun, UnDefend, and BlueHammer are being attacked - heise online
SQ Magazine
Press · 19 Apr 2026, 07:00 · Windows Defender Security Flaws Actively Exploited by Hackers - SQ Magazine
LinkedIn
Press · 18 Apr 2026, 07:00 · WARNING: Three Microsoft Defender Zero-Days Under Active Attack As Two Remain Unpatched - LinkedIn
BornCity
Press · 17 Apr 2026, 07:00 · Windows Defender 0-days: BlueHammer (patched) and RedSun (unpatched)Born's Tech and Windows World - BornCity
Help Net Security
Press · 17 Apr 2026, 07:00 · Researcher drops two more Microsoft Defender zero-days, all three now exploited in the wild - Help Net Security
Field Effect
Press · 17 Apr 2026, 07:00 · Three Microsoft Defender Zero-days Reported Exploited - Field Effect
CyberSecurityNews
Press · 17 Apr 2026, 07:00 · Leaked Windows Defender 0-Day Vulnerability Actively Exploited in Attacks - CyberSecurityNews
Cyber Press
Press · 17 Apr 2026, 07:00 · Windows Defender Zero-Day Leak Fuels Active Exploitation Campaigns - Cyber Press
The Hacker News
Press · 17 Apr 2026, 07:00 · Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched - The Hacker News
BleepingComputer
Press · 17 Apr 2026, 07:00 · Recently leaked Windows zero-days now exploited in attacks - BleepingComputer

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.2 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

1

Public exploit entries / repo candidates

See 1 repos with metrics
RepositoryStarsForksLanguageUpdated
tc4dy/CVE-2026-41091-PoC-Exploit51C++16 Oct 2026, 21:19
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 7.8; EPSS 8.2%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
local access, low privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:08.932646+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
17 Apr 2026, 07:00
Added to the CISA KEV catalog
20 May 2026, 00:00
Published
20 May 2026, 13:09
Latest press mention
22 Sep 2026, 07:00
Score calculated
05 Nov 2026, 14:00
Name
UnDefend
PoCs on GitHub
1 repositories