CVE-2026-41091: Defender privilege escalation to SYSTEM, exploited in the wild

What it is

The Defender Malware Protection Engine follows file links without checking where they lead (CWE-59, “link following”). A local user with a normal account can use that to make Defender act as SYSTEM on a file of the attacker’s choosing. Microsoft rates it 7.8 (high) and says it is publicly disclosed and exploited. CISA added it to the KEV catalog on May 20, 2026.

It is not remote. The attacker needs to run code on the machine first, for example through a stolen VPN login or a phished user. This flaw then turns that foothold into full control of the host.

The description matches RedSun, a public proof of concept released in April 2026 by a researcher known as Nightmare Eclipse. BleepingComputer, citing Will Dormann, says it plants an EICAR test string, wins a race using an oplock, and redirects a file rewrite with a junction to C:\Windows\System32\TieringEngineService.exe, which Windows then runs as SYSTEM. Microsoft has not formally confirmed the match, but The Hacker News reports that the researcher did.

Huntress found RedSun used with BlueHammer (CVE-2026-33825) and UnDefend in a real intrusion on April 16. None of the exploits worked there. The same release also covers CVE-2026-45498, a Defender denial of service that Microsoft also lists as exploited.

Am I affected?

You are affected if Defender is enabled and its Malware Protection Engine is older than 1.1.26040.8. The CVE record gives the range as 1.1.0.0 up to, but not including, 1.1.26040.8. Help Net Security names 1.1.26030.3008 as the affected version. The product list includes Defender Antivirus, System Center Endpoint Protection and Microsoft Security Essentials.

Systems with Defender disabled are not susceptible, according to The Hacker News.

Engine updates arrive automatically by default, so most managed machines should already be fixed. Check machines that:

• block or delay Defender updates,
• are offline for long periods, or are golden images and VDI templates,
• run Windows versions that no longer get updates. Security Essentials may still run there but is not updated.

To check a machine, open Windows Security > Virus & threat protection > Protection updates > Check for updates. Then go to Settings > About and read the version shown. The Hacker News describes this path.

What to do

1. Update the engine to 1.1.26040.8 or later. Run Check for updates under Protection updates in Windows Security, or let your normal Defender update channel deliver it. Microsoft says default settings keep the engine current, so no separate install is needed.
2. Find machines that are behind. Pull the engine version from your endpoint management or Defender inventory and chase everything below 1.1.26040.8. Pay most attention to internet-facing hosts and VPN-connected laptops.
3. There is no workaround from Microsoft. Don’t turn Defender off to avoid the bug unless another endpoint product is protecting the host.
4. If a machine was behind on updates, check it for the signs below. Treat a confirmed hit as a SYSTEM-level compromise: isolate the host, rebuild it, and reset credentials that were used or stored on it.
5. Review how the attacker got in. Huntress traced its case to a FortiGate SSL VPN login with a valid user’s credentials. Look for the same user logging in from several countries in a short time.

Detection

No exploit-specific logs from Microsoft are published. These indicators come from the Huntress case and the public RedSun write-ups:

• Files named RedSun.exe, FunnyApp.exe (BlueHammer) or undef.exe (UnDefend) in Downloads or Pictures folders.
• A Defender EICAR alert tied to an unknown executable. Huntress says this is normal behaviour for RedSun. Also look for Exploit:Win32/DfndrPEBluHmr.BZ alerts, which Defender raised for BlueHammer.
• A temp directory matching %TEMP%\RS-{GUID}\ and a named pipe REDSUN.
• Any change to C:\Windows\System32\TieringEngineService.exe that isn’t from a Windows update. Check the file’s signature and creation time.
• Commands run shortly after the above: whoami /priv, cmdkey /list, net group. Huntress also saw agent.exe -server ... -hide, a tunnel to staybud.dpdns[.]org on port 443.
• Defender definition files (mpavbase.vdm) locked or definitions failing to update, which points to UnDefend.
• In VPN logs: one account logging in from different countries within minutes, or from the IP addresses listed above.

Huntress published a hash only for the BeigeBurrow tunnel. No hashes for RedSun are published, so hunt by name and behaviour, not by hash.