cve-2026-41091

CVE-2026-41091 is a high-severity elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine, disclosed by Microsoft on May 20, 2026. The flaw affects engine version 1.1.26030.3008 and earlier, and is fixed in version 1.1.26040.8. It is a local privilege escalation issue within a core security component present on most supported Windows systems. While Microsoft states that automatic engine updates should remediate the vulnerability, in practice, machines that are most vulnerable are often those least likely to receive updates automatically. This tag covers discussions about the vulnerability details, affected versions, and practical remediation steps for Windows users and IT administrators.