tc4dy/CVE-2026-41091-PoC-Exploit

PoC

CVE-2026-41091 RedSun | Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM - via Cloud Files API + NTFS junction trickery. Forces Defender to write malicious payloads to System32 with SYSTEM rights - Actively exploited in wild. CVSS 7.8. Patch: Defender Engine 1.1.26040.8. Educational & Legal uses only.

view exploit source poc_in_githubauthor tc4dypublished 2026-06-20catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-41091US	—OT critical	0.44% (38th)	KEV	2026-05-20
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan