By Guru Baran
Publication Date: 2026-04-17 05:08:00
A newly disclosed zero-day vulnerability in Microsoft Defender, dubbed “RedSun,” allows an unprivileged user to escalate privileges to full SYSTEM-level access on fully patched Windows 10, Windows 11, and Windows Server 2019 and later systems, and as of now, remains unpatched.
RedSun is the second zero-day exploit published within a two-week span in April 2026 by the security researcher known as “Chaotic Eclipse” (also referred to as Nightmare-Eclipse on GitHub).
The first exploit, BlueHammer, targeted a different Microsoft Defender local privilege escalation (LPE) flaw and was tracked as CVE-2026-33825, which Microsoft patched as part of April 2026’s Patch Tuesday updates.
RedSun follows the same exploit tradition but introduces an entirely new and independent attack vector, suggesting that Defender’s architectural weaknesses run far deeper than a single isolated flaw.
RedSun Exploit for Microsoft Defender
At the heart of…