RoguePlanet and RedSun Exploit Microsoft Defender to Gain SYSTEM Privileges

Security researchers disclosed RoguePlanet and RedSun, two Windows local privilege escalation exploits that abuse Microsoft Defender workflows to elevate a standard user to NT AUTHORITY\SYSTEM on fully patched Windows systems. RoguePlanet weaponizes Defender’s quarantine pipeline through a design-level race condition involving NTFS junctions, opportunistic locks, Volume Shadow Copy, and the Windows Error Reporting QueueReporting scheduled task, while RedSun abuses Defender’s SYSTEM-privileged real-time scanning path with Cloud Files API placeholders, batch oplocks, and junctions to redirect privileged writes into C:\Windows\System32. Reports said the techniques rely on architectural interactions among legitimate Windows components rather than memory corruption or kernel bugs, making them harder to address with traditional exploit mitigations.

RoguePlanet was publicly released by a researcher linked to the Nightmare-Eclipse toolset and was reproduced on Windows 11, with one report saying it had no patch or CVE at disclosure and another identifying it as CVE-2026-50656 and stating it was already under active exploitation on Windows 10 and 11. Microsoft Defender reportedly detects a specific RoguePlanet sample as Exploit:Win32/DfndrRugPlnt.BB, but researchers said the exploit can remain effective after minor source changes and may succeed reliably on some hardware. RedSun was described as part of a broader offensive toolkit with BlueHammer and UnDefend; BlueHammer was patched as CVE-2026-33825, while RedSun and UnDefend were reported as unpatched and active, prompting recommendations to monitor MsMpEng.exe, restrict local access, and reduce SMB exposure until fixes are available.