Loading story…
Microsoft issued out-of-band updates for two Microsoft Defender zero-days, RedSun (CVE-2026-41091) and UnDefend (CVE-2026-45498), after both flaws were exploited in the wild. RedSun is a local privilege escalation vulnerability that can grant attackers SYSTEM privileges by abusing Defender’s handling of malicious files with cloud tags and related Cloud Files behavior, while UnDefend is a denial-of-service flaw that can disrupt Defender signature updates. The bugs affected older versions of the Microsoft Malware Protection Engine and Microsoft Defender Antimalware Platform, and Microsoft said patched engine and platform releases are generally delivered automatically.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-41091 and CVE-2026-45498 to its Known Exploited Vulnerabilities catalog and directed U.S. federal agencies to remediate them by June 3, 2026.
Microsoft issued out-of-band updates for two actively exploited Microsoft Defender zero-days: CVE-2026-41091 (RedSun) and CVE-2026-45498 (UnDefend). The fixes were delivered in newer Malware Protection Engine and Defender Antimalware Platform releases.
After public disclosure of the RedSun and UnDefend flaws, Microsoft said it was investigating the reported issues and working to release updates as quickly as possible.
Security researcher Chaotic Eclipse, also known as Nightmare-Eclipse, publicly disclosed and released proof-of-concept exploits for the RedSun and UnDefend Microsoft Defender vulnerabilities, saying the release was a protest against Microsoft's handling of his reports.
Huntress reported that the RedSun and UnDefend Microsoft Defender zero-days had already been exploited in real-world attacks. The report states exploitation of both vulnerabilities was observed from April 16, 2026.
A public GitHub repository for the RedSun Microsoft Defender exploit was created and released by Nightmare-Eclipse, including source code and technical details describing privilege escalation via Defender behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcexakep.ru
Open sourcedatabreaches.net
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A proof-of-concept exploit for a new Microsoft Defender local privilege escalation flaw dubbed **RedSun** was published by researcher **Chaotic Eclipse**, with reports saying it works on fully patched **Windows 10**, **Windows 11**, and **Windows Server 2019 and later** when Defender is enabled. The zero-day allows an unprivileged local user to gain **SYSTEM** privileges by abusing Defender’s handling of files tagged by cloud detection, and Microsoft had not released a patch at the time of reporting. Independent researcher **Will Dormann** reportedly validated the exploit chain, which uses the **Windows Cloud Files API**, opportunistic locks, and **NTFS junctions/reparse points** to redirect Defender into overwriting a protected binary under `C:\Windows\System32` and then executing it as SYSTEM. The disclosure followed an earlier Defender privilege-escalation exploit, **BlueHammer**, which Microsoft patched as `CVE-2026-33825`, while defenders were urged to watch for anomalous Defender file writes, `cldapi.dll` activity, and oplock-assisted redirection behavior pending a vendor fix.
Jun 29, 2026
Microsoft disclosed active exploitation of two vulnerabilities in Microsoft Defender, **CVE-2026-41091** and **CVE-2026-45498**, prompting CISA to add both flaws to its **Known Exploited Vulnerabilities** catalog. **CVE-2026-41091** affects the Microsoft Malware Protection Engine and is a local privilege escalation issue tied to improper link resolution in Defender’s scanning logic, allowing an authenticated local attacker to obtain **SYSTEM** privileges. **CVE-2026-45498** affects the Microsoft Defender Antimalware Platform and can cause a denial of service that impairs or crashes Defender protection capabilities. Microsoft released fixes in **Microsoft Malware Protection Engine `1.1.26040.8`** and **Microsoft Defender Antimalware Platform `4.18.26040.7`**, with updates delivered through normal Defender mechanisms rather than a separate manual patch. CISA ordered U.S. federal civilian agencies to remediate or discontinue affected products by **June 3, 2026** under **BOD 22-01**. Reporting also linked the exploitation activity to public proof-of-concept releases by researcher **Nightmare Eclipse**, with Huntress observing attackers using Defender exploit code in the wild.
Jun 29, 2026
Microsoft said multiple Windows zero-day vulnerabilities were publicly disclosed without prior coordination, exposing customers before patches or mitigations were ready. The company identified the flaws as **RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma**, affecting components including **Microsoft Defender** and **BitLocker**, and said the releases undermined Coordinated Vulnerability Disclosure practices by giving attackers technical details and proof-of-concept material to weaponize. Microsoft said its security teams are assessing impact, developing updates, and continuing to accept reports through the Microsoft Security Response Center. The disclosures were tied to researcher **Chaotic Eclipse**, also known as **Nightmare-Eclipse**, whose GitHub account was reportedly removed and whose GitLab account was later suspended after exploit tools were mirrored across platforms. Reports said **BlueHammer** (`CVE-2026-33825`) was patched in April and added to CISA’s Known Exploited Vulnerabilities catalog, while **RedSun** and **UnDefend** remained unpatched as of late May; Microsoft and outside researchers said **BlueHammer, RedSun, and UnDefend** were already being exploited in the wild, including in intrusions that began with compromised FortiGate VPN credentials and escalated through Defender flaws. The researcher has accused Microsoft of mishandling earlier communications and threatened another public release, deepening the dispute over vendor coordination and platform enforcement.
Jun 29, 2026