RedSun: Defender zero-day grants SYSTEM access on Windows
TL;DR Summary
A newly disclosed zero-day in Microsoft Defender, dubbed RedSun, lets an unprivileged user escalate to SYSTEM on patched Windows 10/11 and Windows Server 2019+ by abusing Defender’s cloud file handling. The attack rewrites a malicious file back to a system path via cldapi.dll and oplocks, overwriting a system binary in System32 (e.g., TieringEngineService.exe) and gaining full code execution as SYSTEM. CVE-2026-33825 carries a CVSS of 7.8; there is currently no patch. Security teams should monitor Defender file-write activity to System32, look for cldapi.dll-issued redirects, and apply endpoint detection until Microsoft issues a fix.
Topics:technology#cve-2026-33825#cyber-security-news#microsoft-defender#privilege-escalation#windows#zero-day
- Microsoft Defender 0-Day Vulnerability “RedSun” Enables Full SYSTEM Access CyberSecurityNews
- Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched The Hacker News
- Recently leaked Windows zero-days now exploited in attacks BleepingComputer
- From the BlueHammer author: New Windows zero-day grants admin rights heise online
- RedSun: Windows 0day when Defender becomes the attacker CloudSEK
Reading Insights
Total Reads
1
Unique Readers
24
Time Saved
53 min
vs 54 min read
Condensed
99%
10,790 → 93 words
Want the full story? Read the original article
Read on CyberSecurityNews