Microsoft Defender Zero-Days RedSun and UnDefend Exploited Before Emergency Fixes

Microsoft issued out-of-band updates for two Microsoft Defender zero-days, RedSun (CVE-2026-41091) and UnDefend (CVE-2026-45498), after both flaws were exploited in the wild. RedSun is a local privilege escalation vulnerability that can grant attackers SYSTEM privileges by abusing Defender’s handling of malicious files with cloud tags and related Cloud Files behavior, while UnDefend is a denial-of-service flaw that can disrupt Defender signature updates. The bugs affected older versions of the Microsoft Malware Protection Engine and Microsoft Defender Antimalware Platform, and Microsoft said patched engine and platform releases are generally delivered automatically.