RedSun: When Windows Defender Becomes the Attacker's Ladder
A Public Proof-of-Concept Turns a Patched Defender Flaw Into a Real Threat
Date: April 16, 2026 Primary Sources: Microsoft MSRC — CVE-2026-33825, NVD — CVE-2026-33825, Cybernews — RedSun Public Release
Executive Summary
- What: CVE-2026-33825 is a local privilege escalation vulnerability in the Microsoft Defender Antimalware Platform, patched April 14, 2026. The day after the patch, a researcher using the pseudonym "Chaotic Eclipse" published a working proof-of-concept exploit named RedSun to a public GitHub repository.
- Who is affected: Any Windows endpoint running Microsoft Defender Antimalware Platform below version 4.18.26050.3011 that has not yet applied the April 2026 Patch Tuesday updates.
- Severity: High — CVSS 3.1 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Action required: Apply the April 2026 Patch Tuesday update immediately. Organizations running White Cloud Security (WCS) Trust Lockdown in Block Mode were protected against the downstream execution step regardless of patch status.
Key Takeaways
- CVE-2026-33825 allows a low-privilege local user to escalate to NT AUTHORITY\SYSTEM via a logic flaw in Windows Defender's access control.
- RedSun is a publicly released PoC that proves the vulnerability is exploitable — lowering the bar for anyone who wants to test or weaponize it.
- Microsoft patched the flaw in the April 2026 Patch Tuesday cycle. Patching is the correct first response.
- The patch eliminates the vulnerability — but patching lags, delayed deployments, and third-party Windows images mean real exposure windows exist.
- White Cloud Security Trust Lockdown enforces approved-only execution, stopping the payload at the execution boundary regardless of what account or process initiates the launch.
- SYSTEM-level authority does not bypass WCS. Execution approval — not privilege level — is the control point.
What Is the RedSun Defender Exploit
On April 15, 2026 — one day after Microsoft's April Patch Tuesday release — a researcher operating under the pseudonym "Chaotic Eclipse" uploaded a proof-of-concept exploit to a public GitHub repository. The researcher named it RedSun. (Cybernews)
RedSun is not a new vulnerability. It is a working exploit for CVE-2026-33825, a flaw that Microsoft patched the previous day. The researcher described it as the second public Defender exploit they have released, following an earlier tool called BlueHammer. The public release was framed as a response to frustration with Microsoft's Security Response Center — the researcher claimed MSRC had mishandled their disclosure.
The mechanics of RedSun exploit a logic error in Defender's engine update handling. According to public reporting, the flaw can force Windows Defender to act as a delivery mechanism for a malicious payload, allowing an attacker to leverage a trusted, privileged system process — the very security tool itself — to achieve escalated execution. (GBHackers)
The researcher has indicated that further exploits, including remote code execution PoCs, may follow.
What Microsoft Patched — CVE-2026-33825
| Field | Detail |
|---|---|
| CVE ID | CVE-2026-33825 |
| CVSS 3.1 Base Score | 7.8 (HIGH) |
| CVSS Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CWE | CWE-1220 — Insufficient Granularity of Access Control |
| Affected Component | Microsoft Defender Antimalware Platform |
| Vulnerable Versions | Below 4.18.26050.3011 |
| Fixed Version | 4.18.26050.3011 |
| Attack Vector | Local — requires low-privilege account on the target |
| User Interaction | None required |
| Exploited in the Wild | Not confirmed as of publication date |
| Patch Available | Yes — April 14, 2026 (Patch Tuesday) |
| Public PoC Available | Yes — RedSun, published April 15, 2026 |
The root cause, according to Microsoft and NVD, is insufficient granularity of access control (CWE-1220) within the Defender Antimalware Platform. An authorized attacker — meaning any user with a valid low-privilege local account — can exploit this flaw to elevate their privileges to NT AUTHORITY\SYSTEM without any additional user interaction. (Microsoft MSRC, NVD)
The fact that Defender itself is the vulnerable component is operationally significant. Defender runs with elevated trust. It is typically excluded from behavioral monitoring by other security tools. It operates continuously in the background with privileged system access. When that trusted component contains an exploitable flaw, it becomes a path of least resistance for attackers who already have a foothold on a machine.
Why This Vulnerability Is Dangerous
A CVSS score of 7.8 places this firmly in the High severity tier. But the score alone understates the operational risk.
Patching is the right answer — and patching takes time. Enterprise environments run Patch Tuesday updates on staggered schedules. Laptops not connected to VPN may not receive updates for days. Third-party Windows images and golden templates may not be refreshed for weeks. Gold builds for embedded or industrial systems may have even longer update cycles. During every day that passes between the patch release and its deployment, CVE-2026-33825 is an open door on any unpatched endpoint.
A working public PoC turns a theoretical risk into a practical one. Before RedSun was published, exploiting this flaw required a capable threat actor who had independently developed or purchased a working exploit. After RedSun's publication, the barrier dropped significantly. Any attacker with basic scripting skills and local access to an unpatched endpoint can test it. Copycat development accelerates from here.
Privilege escalation is not the goal — it is the means. An attacker who achieves SYSTEM-level access can:
- Write files to protected directories
- Replace legitimate binaries, DLLs, or scripts with malicious ones
- Disable or tamper with security tooling
- Establish persistent access that survives reboots
- Deliver and execute additional payloads with elevated authority
The escalation step is the bridge. The real target is the execution that follows.
How the Attack Chain Works
A full RedSun attack against an unpatched endpoint looks like this:
- Initial access — The attacker gains a low-privilege foothold on the target machine. This could be via phishing, a compromised credential, an RMM tool, or a separate unrelated vulnerability.
- Trigger the Defender vulnerability — With local access and a low-privilege account, the attacker runs the RedSun exploit against CVE-2026-33825, leveraging a logic flaw in Defender's update handling or file processing mechanism.
- Privilege escalation to SYSTEM — The exploit forces Defender to act as a delivery conduit, elevating the attacker's session to NT AUTHORITY\SYSTEM.
- File system access — Now running as SYSTEM, the attacker can write to protected directories, replace signed binaries, or plant DLLs and scripts in locations that would normally be off-limits to unprivileged users.
- Payload execution — The attacker attempts to launch the planted payload — a dropped executable, a replaced DLL, a PowerShell script, or an unauthorized loader.
Step 5 is where the attack chain either succeeds or fails completely. The graphic below shows what happens at that boundary under each security model.
MITRE ATT&CK Mapping:
| Phase | Technique |
|---|---|
| Privilege Escalation | T1068 — Exploitation for Privilege Escalation |
| Defense Evasion | T1211 — Exploitation for Defense Evasion |
| Persistence | T1574 — Hijack Execution Flow (DLL / binary replacement) |
| Execution | T1059 — Command and Scripting Interpreter |
The Real Failure: Execution Control
Here is the insight that most incident post-mortems miss:
The vulnerability is not the end goal — execution of unauthorized code is.
CVE-2026-33825 lets an attacker reach SYSTEM. But SYSTEM is not the win. SYSTEM is the means to run something. An attacker who achieves SYSTEM and cannot run a payload has gained nothing. The entire exploit chain — foothold, privilege escalation, file placement — is preamble. The outcome is determined entirely at the moment of execution.
The traditional security model
Traditional endpoint security — antivirus, EDR, behavioral monitoring — is fundamentally oriented around detection:
- A file is scanned against known signatures
- A behavior is flagged as suspicious after it begins executing
- An alert is generated, and a response is initiated
This model has a structural problem: it assumes that code may begin executing before a decision about its legitimacy is reached. Detection-first security gives sophisticated attackers room to operate in that gap. When the attacker uses a trusted system process like Defender as their launch vehicle, behavioral heuristics may not fire at all — because the process initiating the action carries an inherently trusted identity.
The White Cloud Security Model
White Cloud Security operates on a fundamentally different premise. Under WCS Trust Lockdown, software is blocked by default unless explicitly approved:
- Execution permission is granted through admin-approved Trust Profiles and code-signing certificates
- File identity is verified using a handprint — a multi-hash plus file-length fingerprint — that cannot be spoofed by renaming a file or altering metadata
- Approval is evaluated at the moment of execution, not after the fact
The model does not ask: Is this file known bad?
It asks: Has this file been explicitly approved to run?
If the answer is no — it does not run. The account that initiated the launch does not change that outcome.
How White Cloud Security Trust Lockdown Stops This Attack
Even if an attacker successfully:
- Exploits CVE-2026-33825
- Escalates to NT AUTHORITY\SYSTEM using RedSun
- Writes malicious files into protected Windows directories
- Replaces a legitimate binary, DLL, or script
White Cloud Security Trust Lockdown will still block execution of any unauthorized file.
Here is how each attack step maps to a WCS control:
| Attack Step | WCS Response |
|---|---|
| Dropped executable (new payload) | Blocked — not in approved Trust Profile, fails execution check |
| Malicious DLL injected into system path | Blocked — handprint mismatch against approved DLL identity |
| Script payload (PowerShell, VBScript, cmd) | Blocked — script execution governed by approved interpreter and approved script identity |
| Replaced system binary | Blocked — the replacement file carries a different handprint than the approved version; execution denied |
| Unauthorized updater or loader | Blocked — no approval exists for the new binary identity |
The WCS approval check sits at the execution boundary. It does not matter that the file was placed by a SYSTEM-level process. It does not matter that the initiating account has Administrator credentials. It does not matter whether Defender is patched or unpatched.
Execution approval — not privilege level — is the control point.
White Cloud Security blocks unauthorized software even when launched by a SYSTEM-level Administrator account.
This is the structural difference between a detection-first and a prevention-first security model. An attacker who reaches SYSTEM through RedSun has not bypassed WCS — they have only succeeded in reaching the execution boundary, where they will be stopped.
At White Cloud Security, we continue to track and report new hacking methods and tools — not just because of the immediate threat, but because patterns of reuse often expose the playbooks of these cybercriminal groups.
White Cloud Security vs. Traditional Endpoint Security
Defender / AV-Centric Model
- Detection-and-response orientation — the primary workflow is: allow execution, monitor behavior, detect anomaly, remediate
- Signature, reputation, or behavioral logic dependent — detection quality is bounded by the quality of current threat intelligence
- Assumes execution may occur before successful remediation — the detection gap is a structural feature of the model
- Can itself become part of the attack surface — CVE-2026-33825 demonstrates that the security tool can be the vulnerable component; when Defender is the attack vector, Defender's detection logic cannot be the defense
White Cloud Security Trust Lockdown
- Default-deny / approved-only execution — code that has not been explicitly approved cannot run, regardless of how it was delivered or by whom
- Independent of malware signature timing — a zero-day payload that has never been seen before is still blocked; it has not been approved
- Blocks execution before damage occurs — there is no detection gap because the code never begins executing
- Not bypassed by SYSTEM privilege — privilege level is not an authorization mechanism under the WCS model
- Handprint identity verification — multi-hash plus file-length fingerprints ensure that file replacement attacks (a common post-SYSTEM tactic) are caught at execution time
- Trust Profiles with admin-approved code-signing certificates — software authorization is explicit, auditable, and scoped
The comparison is not "better detection" versus "worse detection." It is detection versus prevention. For attacks that abuse trusted system components, prevention is the only reliable answer.
Practical Defensive Steps
Immediate (Patch Priority)
- Apply the April 2026 Patch Tuesday update — ensure Microsoft Defender Antimalware Platform is at version 4.18.26050.3011 or later on all endpoints.
- Verify deployment coverage — use your endpoint management platform to confirm patch status across mobile, remote, and offline devices. Do not assume update completion.
- Check golden images and deployment templates — update base images to include the April 2026 patches before any new endpoint provisioning.
Detection (For Unpatched Windows Endpoints)
Monitor for exploitation indicators:
- Event ID 4672 — Special Logon: SYSTEM privileges appearing from a non-privileged process context
- Event ID 4688 — Process Creation as SYSTEM from an unexpected parent process
- Symbolic link creation attempts from low-privilege processes targeting Defender-controlled paths
- Unusual new processes spawning under SYSTEM authority within post-exploit timeframes
Indicators of Compromise
No IOCs (file hashes, domains, or IP addresses) associated with RedSun in-the-wild exploitation have been publicly confirmed as of the date of this publication. RedSun is a PoC released to GitHub; any operational weaponization would use modified or custom variants. Do not rely on IOC matching as a primary control for this threat.
Structural (Longer-Term)
- Deploy WCS Trust Lockdown in Block Mode — enforce execution approval for all binaries, DLLs, and scripts on endpoints. This stops the payload execution step regardless of patch status or privilege level.
- Scope application approval tightly — review and prune Trust Profiles to ensure only operationally required software is approved for execution.
- Treat SYSTEM-level processes as zero-trust — review any assumption in your security architecture that SYSTEM-level or Administrator-level execution is implicitly trusted.
Final Takeaways
- CVE-2026-33825 is a real, patched, High-severity local privilege escalation vulnerability in Microsoft Defender. Apply the April 2026 Patch Tuesday update.
- RedSun lowers the exploitation barrier significantly. A working public PoC means the risk is no longer theoretical for unpatched machines.
- Privilege escalation is the means, not the goal. The attacker's real objective is executing unauthorized code, and that step happens after SYSTEM is achieved.
- White Cloud Security Trust Lockdown blocks all unauthorized software at the execution boundary — regardless of whether the initiating process is a standard user, an administrator, or NT AUTHORITY\SYSTEM.
- The security tool itself can be the vulnerability. Organizations that depend entirely on Defender for execution-layer protection should evaluate what happens when Defender is the attack vector.
- Attackers do not win by gaining SYSTEM — they win by executing unauthorized code. White Cloud Security stops that execution, even under SYSTEM-level authority.
Alternate Blog Titles
- CVE-2026-33825: Why Patching Defender Isn't Enough If Execution Isn't Controlled
- RedSun PoC: A Public Exploit, a Patched Flaw, and the Defense That Doesn't Care About Either
- SYSTEM Privilege Won't Save the Attacker: How White Cloud Security Blocks the RedSun Attack Chain
Alternate Meta Descriptions
- RedSun is a public exploit for CVE-2026-33825, a patched Windows Defender privilege escalation flaw. White Cloud Security Trust Lockdown stops the execution step — the part that actually causes damage — regardless of privilege level.
- A public PoC for a patched Defender vulnerability shows why execution control matters more than privilege. White Cloud Security blocks unauthorized code even when launched by SYSTEM.
Social Media Blurbs
- LinkedIn: "RedSun is a public exploit for CVE-2026-33825 — a patched Windows Defender flaw that escalates to SYSTEM. The patch matters. But so does what happens after SYSTEM. WCS Trust Lockdown blocks unauthorized execution at that final step, regardless of what account launched it."
- Twitter/X: "CVE-2026-33825: patched. RedSun PoC: public. SYSTEM privilege: not the same as execution permission. WCS blocks the payload even when it's launched by SYSTEM. #ZeroTrust #TrustLockdown #WindowsDefender"
- Mastodon/Bluesky: "When your security tool is the vulnerability: CVE-2026-33825 lets attackers abuse Windows Defender itself to reach SYSTEM. WCS Trust Lockdown enforces approved-only execution — no signature, no privilege level, no detection timing required. Blocked at the boundary."
References
- Microsoft Security Response Center — CVE-2026-33825
- NVD — CVE-2026-33825
- Cybernews — Second Public Windows Defender Exploit Released
- GBHackers — New PoC Exploit Published for Microsoft Defender 0-Day Flaw
- SecurityOnline — RedSun: New Windows Defender Zero-Day Turns Protector into Attacker
- April 2026 Patch Tuesday Analysis — CrowdStrike