Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days
Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days
https://www.securityweek.com/microsoft-patches-exploited-undefend-and-redsun-defender-zero-days/
Publish Date: 2026-05-21 05:52:00
Source Domain: www.securityweek.com
Microsoft this week released patches for two vulnerabilities in Defender, warning they have been exploited in the wild as zero-days.
The first, tracked as CVE-2026-41091 (CVSS score of 7.8), is described as a link-following issue that allows attackers to elevate their privileges to System.
“Improper link resolution before file access (‘link following’) in Microsoft Defender allows an authorized attacker to elevate privileges locally,” Microsoft notes in its bare-bones advisory.
The second bug, tracked as CVE-2026-45498 (CVSS score of 4.0), is a denial-of-service (DoS) flaw.
Microsoft addressed the two security defects in Microsoft Defender Antimalware Platform version 4.18.26040.7. According to the company, systems with Microsoft Defender disabled are not exploitable, even though Defender’s files remain on disk.
The company warned that both vulnerabilities have been publicly disclosed and that in-the-wild exploitation was detected, but did not provide further details.
According to a post by Microsoft MVP Fabian Bader, the two vulnerabilities are the RedSun and UnDefend variants of the BlueHammer exploit that security researcher Chaos Eclipse dropped publicly last month. BlueHammer has also been exploited in the wild.
On Wednesday, the US cybersecurity agency CISA added both flaws to its Known Exploited Vulnerabilities (KEV) list, urging federal agencies to patch them by June 3.
The fresh Defender bugs were added to CISA’s KEV list alongside five other issues, all disclosed over half a decade ago.
The oldest of the five is CVE-2008-4250, a remote code execution (RCE) weakness in the Server service of older Windows iterations that can be exploited via crafted RPC requests.
Next in line is CVE-2009-1537, a NULL byte overwrite issue in Microsoft DirectX that could be exploited for RCE via crafted QuickTime media files. It was flagged as exploited in the wild in May 2009.
The…
