Loading story…
Elastic Security Labs detailed Redux, a Windows kernel-exploitation technique in the False File Immutability (FFI) class that abuses the Cloud Files subsystem and its cldflt.sys Cloud Filter driver. The technique defeats assumptions that executable image files cannot change once opened without write sharing: an attacker can alter DLL contents after they have been mapped and validated under Windows Code Integrity. Redux can elevate execution to WinTcb-Light through a protected process; when paired with GodFault-Redux, it can compromise kernel memory and terminate protected Microsoft Defender processes.
FFI stems from software treating file-sharing restrictions, such as those controlled through Windows file-opening APIs including CreateFileW, as a security boundary rather than ensuring underlying data remains immutable. Earlier FFI research demonstrated catalog-file swapping through a network redirector, enabling an administrator-level attacker to load an unsigned kernel driver; Microsoft addressed that path in Windows 11 23H2 through page locking and HVCI protections. Microsoft added a Redux mitigation in Windows 11 24H2 and Windows Server 2025, but Elastic reported the Cloud Files path remained exploitable on fully patched Windows 10 Enterprise LTSC 2021, Windows Server 2022, and Windows Server 2019 as of February 2026. Elastic Defend 8.14 and later offers an optional mitigation to block the exploit pattern.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
As of February 2026, Redux remained exploitable on fully patched Windows 10 Enterprise LTSC 2021, Windows Server 2022, and Windows Server 2019; researchers demonstrated LSASS dumping on Windows Server 2022 build 20348.4773.
Windows 11 24H2 reached general availability with a mitigation for the Redux Cloud Files exploitation technique.
Microsoft released KB5037771 generally for Windows 11 23H2, mitigating ItsNotASecurityBoundary by pinning mapped catalog pages with MmProbeAndLockPages.
Microsoft released KB5036980, a preview mitigation for ItsNotASecurityBoundary in Windows 11 23H2.
Microsoft's Windows Defender team contacted the researchers to coordinate disclosure of Redux. Microsoft researcher Philip Tsukerman had independently identified the issue, and a fix was in prerelease testing.
Elastic Security Labs reported the ItsNotASecurityBoundary Code Integrity catalog-processing vulnerability and its proposed minifilter mitigation to MSRC as VULN-119340.
Elastic Security Labs reported the Redux false-file-immutability issue affecting the Windows Cloud Files subsystem to Microsoft's Security Response Center.
Microsoft Defender released a mitigation enforcing dynamic page hashes for executable images loaded through network redirectors, breaking the PPLFault exploitation path.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourceelastic.co
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed exploitation of two Windows Cloud Files Mini Filter Driver vulnerabilities in `cldflt.sys`—`CVE-2021-31969` and `CVE-2024-30085`—that allow local attackers to escalate privileges to **NT AUTHORITY\SYSTEM** through kernel heap corruption. In the older bug, a missing lower-bound validation in `HsmpRpiDecompressBuffer` caused an integer underflow that led to a controlled paged-pool overflow during `RtlDecompressBuffer` processing. The issue affected Windows 10 1809-21H2 and Windows Server 2019, and could be triggered by registering a sync root, planting crafted cloud-file reparse data in a directory, and invoking filesystem operations such as opening a handle to that directory.
Jun 29, 2026
A proof-of-concept exploit for a new Microsoft Defender local privilege escalation flaw dubbed **RedSun** was published by researcher **Chaotic Eclipse**, with reports saying it works on fully patched **Windows 10**, **Windows 11**, and **Windows Server 2019 and later** when Defender is enabled. The zero-day allows an unprivileged local user to gain **SYSTEM** privileges by abusing Defender’s handling of files tagged by cloud detection, and Microsoft had not released a patch at the time of reporting. Independent researcher **Will Dormann** reportedly validated the exploit chain, which uses the **Windows Cloud Files API**, opportunistic locks, and **NTFS junctions/reparse points** to redirect Defender into overwriting a protected binary under `C:\Windows\System32` and then executing it as SYSTEM. The disclosure followed an earlier Defender privilege-escalation exploit, **BlueHammer**, which Microsoft patched as `CVE-2026-33825`, while defenders were urged to watch for anomalous Defender file writes, `cldapi.dll` activity, and oplock-assisted redirection behavior pending a vendor fix.
Jun 29, 2026
Elastic Security Labs disclosed two Windows zero-day exploit paths that enable attackers with local administrator privileges to bypass Protected Process Light (PPL) protections and escalate from PPL to kernel-level execution. The `PPLFault` and `GodFault` techniques can disable Windows Defender and other AV/EDR controls without a bring-your-own-vulnerable-driver (BYOVD) component, undermining controls intended to restrict administrator-driven kernel tampering. The techniques operate despite Windows defenses including Driver Signing Enforcement, Secure Boot, and the Vulnerable Driver Blocklist, which limit untrusted kernel drivers but do not prevent this driverless exploit chain. Microsoft reportedly declined to patch the issues because exploitation requires administrator access; Elastic released the NoFault kernel driver as an interim PPL mitigation and integrated protection into Elastic Endpoint/Defend version 8.9.0 and later, while the underlying kernel escalation remained unpatched.
Aug 26, 2026