Microsoft Defender RedSun Zero-Day Enables SYSTEM Privilege Escalation

A proof-of-concept exploit for a new Microsoft Defender local privilege escalation flaw dubbed RedSun was published by researcher Chaotic Eclipse, with reports saying it works on fully patched Windows 10, Windows 11, and Windows Server 2019 and later when Defender is enabled. The zero-day allows an unprivileged local user to gain SYSTEM privileges by abusing Defender’s handling of files tagged by cloud detection, and Microsoft had not released a patch at the time of reporting.

Independent researcher Will Dormann reportedly validated the exploit chain, which uses the Windows Cloud Files API, opportunistic locks, and NTFS junctions/reparse points to redirect Defender into overwriting a protected binary under C:\Windows\System32 and then executing it as SYSTEM. The disclosure followed an earlier Defender privilege-escalation exploit, BlueHammer, which Microsoft patched as CVE-2026-33825, while defenders were urged to watch for anomalous Defender file writes, cldapi.dll activity, and oplock-assisted redirection behavior pending a vendor fix.