Cybersecurity

Microsoft Defender "RedSun" Zero-Day PoC Grants SYSTEM Privileges

April 16, 2026 · Updated October 11, 2026 · Jonanna Mason · Reviewed by Cody Carrico, Vice President & COO

In April 2026, a proof-of-concept exploit called "RedSun" turned Microsoft Defender's own file restoration logic into a path to SYSTEM privileges. Microsoft released a fix on May 19, 2026 (CVE-2026-41091). Here is how the attack worked and how to confirm your endpoints are patched.

Status as of October 11, 2026: Microsoft released a fix on May 19, 2026 for CVE-2026-41091, a Microsoft Defender elevation-of-privilege flaw that security researchers have tied to RedSun. Microsoft marked it as exploited, and CISA added it to its Known Exploited Vulnerabilities catalog on May 20, 2026. The fix is in Microsoft Malware Protection Engine version 1.1.26040.8 or later. The rest of this article describes the situation as it stood when it was first published in April 2026.

A security researcher using the alias "Chaotic Eclipse" has released a proof-of-concept exploit called "RedSun" that turns Microsoft Defender against the systems it is supposed to protect.

The exploit escalates privileges from a standard, low-privileged user account to NT AUTHORITY\SYSTEM, which is the highest privilege level available on a Windows machine. When it was released, it worked on systems with all April 2026 updates installed.

A Pattern of Releases

This disclosure is part of a troubling pattern. Within a 13-day window in April 2026, the same researcher released three separate exploits targeting Microsoft Defender:

- BlueHammer:

Tied to CVE-2026-33825, addressed in the April 2026 Patch Tuesday release.

- UnDefend:

Designed to quietly degrade Defender's update mechanism over time.

- RedSun:

The third and most aggressive of the three, and unpatched when it was released.

Independent researcher Will Dormann reported that RedSun worked reliably in his testing against Windows 11 and Windows Server with April 2026 updates applied, as well as Windows 10, as long as Microsoft Defender was enabled.

How RedSun Works

RedSun abuses a logic flaw in how Microsoft Defender handles files marked with a "cloud" attribute using the Windows Cloud Files API. When Defender encounters a file tagged this way, the antivirus engine attempts to restore the file to its original location rather than simply quarantining it. RedSun hijacks that process.

The attack chain works as follows:

1. 1. The attacker places a crafted file in a location where Defender will detect it.
2. 2. Before Defender can fully act, the attacker replaces the file with a cloud placeholder.
3. 3. As Defender initiates its rollback operation, the attacker uses NTFS junctions and opportunistic locks to pause the file operation and redirect the target write path to a critical system directory, such as C:\Windows\System32.
4. 4. When the lock is released and Defender resumes, it follows the redirected path and writes the file using its own SYSTEM-level privileges.
5. 5. The attacker can use this to overwrite a legitimate Windows service binary with a malicious payload.

The next time that service runs, the attacker achieves full system control without ever needing elevated privileges, administrative rights, or user interaction. In effect, the exploit turns Microsoft's own security tooling into a delivery mechanism for malicious payloads.

CVE and Disclosure Context

The original BlueHammer vulnerability is tracked as CVE-2026-33825, rated 7.8 out of 10 and classified as "Important." RedSun was a separate attack path that remained unpatched until May 2026. The vulnerability class is insufficient granularity of access control, which allowed Defender's privileged file operations to be redirected by a low-privileged attacker.

Chaotic Eclipse stated that initial disclosure attempts through the Microsoft Security Response Center were not handled to their satisfaction, which prompted the public release. Microsoft credited separate researchers, Zen Dodd and Yuanpei XU, for the disclosure of CVE-2026-33825, which was addressed in the April Patch Tuesday update cycle.

Patching and Immediate Mitigation Steps

For the BlueHammer vulnerability (CVE-2026-33825), organizations should verify that Microsoft Defender Antimalware Platform version 4.18.26050.3011 or higher is installed. Platform updates are distributed through Windows Update and typically happen automatically. Administrators should confirm the patched version is reflected across all endpoints.

For the RedSun path, Microsoft had not issued a formal statement, emergency patch, or documented workaround when this article was first published. Its May 19, 2026 fix for CVE-2026-41091 is delivered through Defender engine updates, so confirm that every endpoint reports Microsoft Malware Protection Engine version 1.1.26040.8 or later. Do not switch off Defender features in response to issues like this: turning off real-time or cloud-delivered protection removes far more coverage than this local privilege-escalation path puts at risk. Keep the Defender antimalware platform and security intelligence current so a fix applies as soon as Microsoft ships it, and rely on the mitigations below in the meantime.

Additional mitigations include:

• Enforcing least-privilege access controls so standard users cannot write to or execute from user-writable directories near system paths.
• Enabling behavioral monitoring and endpoint detection and response tools to catch abnormal file write activity by Defender processes.
• Segmenting networks to limit lateral movement if a workstation is compromised.

What This Means for Your Organization

This exploit cluster highlights the risk of relying on a single endpoint protection solution without supporting controls. Ransomware operators and advanced threat actors are known to integrate public local privilege escalation code within days of release. A reliable, weaponized proof-of-concept means the window to patch or mitigate is very short.

Because RedSun requires local access to execute, the primary concern is post-initial-access scenarios. An attacker who gains a foothold through phishing, a compromised credential, or a vulnerable application can use RedSun to immediately escalate privileges and take full control of the machine.

Organizations should take these steps now:

• Confirm every endpoint runs Microsoft Malware Protection Engine version 1.1.26040.8 or later, which addresses CVE-2026-41091.
• Apply the April 2026 and later Patch Tuesday updates if not already done.
• Validate Defender platform and engine versions across all endpoints.
• Review user privilege assignments to reduce the impact of any compromise.

Cyber One Solutions monitors emerging threats and vulnerability disclosures continuously. If your organization needs help assessing exposure, reviewing endpoint configurations, or setting up compensating controls, contact our team today.