Loading story…
Microsoft patched two actively exploited vulnerabilities in Microsoft Defender and related protection components, including CVE-2026-41091, a high-severity local privilege escalation flaw that can give an attacker NT AUTHORITY\SYSTEM privileges, and CVE-2026-45498, a medium-severity denial-of-service issue that can make Defender unavailable. The affected products include Microsoft Malware Protection Engine version 1.1.26030.3008 and earlier and Microsoft Defender Antimalware Platform version 4.18.26030.3011 and earlier, and both CVEs were added to CISA’s Known Exploited Vulnerabilities catalog due to active exploitation in the wild.
Technical analysis of CVE-2026-41091, dubbed RedSun, says the bug lies in Windows Defender’s file remediation workflow when it processes malicious files marked as Cloud Files placeholders. A standard user can abuse Defender’s SYSTEM-level file operations, together with NTFS junctions and oplocks, to redirect a privileged write into C:\Windows\System32, plant a malicious binary such as TieringEngineService.exe, and then trigger execution through Storage Tiers Management COM activation to obtain a SYSTEM shell. Microsoft said the issues were fixed through automatic updates and urged organizations that disable auto-updates to manually update Defender and any products using the same engine and platform components.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A Calif blog post analyzed the RedSun exploit for CVE-2026-41091, describing how Windows Defender's remediation workflow could be abused to gain arbitrary writes into System32 and execute code as NT AUTHORITY\SYSTEM. The write-up attributed discovery of the flaw to Nightmare Eclipse and documented a six-stage exploit chain involving Cloud Files placeholders, NTFS junctions, oplocks, and COM activation.
CISA added both Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities catalog, indicating they were being actively exploited in the wild. The listing elevated the significance of the flaws beyond Microsoft's patching notice.
Microsoft addressed CVE-2026-41091, a local privilege escalation flaw, and CVE-2026-45498, a denial-of-service flaw, in Microsoft Defender and related protection components via automatic updates. CSIRT.SK reported the fixes affect Malware Protection Engine version 1.1.26030.3008 and earlier and Defender Antimalware Platform version 4.18.26030.3011 and earlier.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
blog.calif.io
Open sourcecsirt.sk
Open sourcecve.org
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A proof-of-concept exploit for a new Microsoft Defender local privilege escalation flaw dubbed **RedSun** was published by researcher **Chaotic Eclipse**, with reports saying it works on fully patched **Windows 10**, **Windows 11**, and **Windows Server 2019 and later** when Defender is enabled. The zero-day allows an unprivileged local user to gain **SYSTEM** privileges by abusing Defender’s handling of files tagged by cloud detection, and Microsoft had not released a patch at the time of reporting. Independent researcher **Will Dormann** reportedly validated the exploit chain, which uses the **Windows Cloud Files API**, opportunistic locks, and **NTFS junctions/reparse points** to redirect Defender into overwriting a protected binary under `C:\Windows\System32` and then executing it as SYSTEM. The disclosure followed an earlier Defender privilege-escalation exploit, **BlueHammer**, which Microsoft patched as `CVE-2026-33825`, while defenders were urged to watch for anomalous Defender file writes, `cldapi.dll` activity, and oplock-assisted redirection behavior pending a vendor fix.
Jun 29, 2026
Microsoft disclosed active exploitation of two vulnerabilities in Microsoft Defender, **CVE-2026-41091** and **CVE-2026-45498**, prompting CISA to add both flaws to its **Known Exploited Vulnerabilities** catalog. **CVE-2026-41091** affects the Microsoft Malware Protection Engine and is a local privilege escalation issue tied to improper link resolution in Defender’s scanning logic, allowing an authenticated local attacker to obtain **SYSTEM** privileges. **CVE-2026-45498** affects the Microsoft Defender Antimalware Platform and can cause a denial of service that impairs or crashes Defender protection capabilities. Microsoft released fixes in **Microsoft Malware Protection Engine `1.1.26040.8`** and **Microsoft Defender Antimalware Platform `4.18.26040.7`**, with updates delivered through normal Defender mechanisms rather than a separate manual patch. CISA ordered U.S. federal civilian agencies to remediate or discontinue affected products by **June 3, 2026** under **BOD 22-01**. Reporting also linked the exploitation activity to public proof-of-concept releases by researcher **Nightmare Eclipse**, with Huntress observing attackers using Defender exploit code in the wild.
Jun 29, 2026
Security researchers disclosed **RoguePlanet** and **RedSun**, two Windows local privilege escalation exploits that abuse Microsoft Defender workflows to elevate a standard user to `NT AUTHORITY\SYSTEM` on fully patched Windows systems. RoguePlanet weaponizes Defender’s quarantine pipeline through a design-level race condition involving **NTFS junctions**, **opportunistic locks**, **Volume Shadow Copy**, and the Windows Error Reporting `QueueReporting` scheduled task, while RedSun abuses Defender’s SYSTEM-privileged real-time scanning path with **Cloud Files API placeholders**, batch oplocks, and junctions to redirect privileged writes into `C:\Windows\System32`. Reports said the techniques rely on architectural interactions among legitimate Windows components rather than memory corruption or kernel bugs, making them harder to address with traditional exploit mitigations. RoguePlanet was publicly released by a researcher linked to the **Nightmare-Eclipse** toolset and was reproduced on Windows 11, with one report saying it had no patch or CVE at disclosure and another identifying it as **`CVE-2026-50656`** and stating it was already under active exploitation on Windows 10 and 11. Microsoft Defender reportedly detects a specific RoguePlanet sample as `Exploit:Win32/DfndrRugPlnt.BB`, but researchers said the exploit can remain effective after minor source changes and may succeed reliably on some hardware. RedSun was described as part of a broader offensive toolkit with **BlueHammer** and **UnDefend**; BlueHammer was patched as **`CVE-2026-33825`**, while RedSun and UnDefend were reported as unpatched and active, prompting recommendations to monitor `MsMpEng.exe`, restrict local access, and reduce SMB exposure until fixes are available.
Jul 12, 2026