RedSun Exploit Uses Windows Defender to Gain SYSTEM Privileges
Summary
RedSun exploits a missing reparse-point check in Windows Defender’s remediation process, allowing a local unprivileged user to redirect a file write into System32 and run code as SYSTEM. The article reports that no patch was available at publication.
Key points
- The flaw is in Defender’s remediation write-back path, which reportedly uses the original file path without checking whether it has been redirected through a junction.
- The exploit combines a batch OPLOCK race, a Cloud Files placeholder, a Volume Shadow Copy trigger, and a junction pointing to C:\Windows\System32.
- Defender writes an attacker-controlled binary into System32 with SYSTEM privileges; the exploit then invokes the Storage Tiers Management COM server to execute it.
- The article reports confirmation on Windows 11 25H2 Build 26200.8246 and says the flaw may affect other Windows versions.
- The attack requires local unprivileged access and reportedly works with real-time protection enabled; no administrator interaction or kernel exploit is needed.
- At the time of writing, the article says no patch or CVE had been issued.
- Suggested interim monitoring includes unusual VSS enumeration, Cloud Files sync-root registration, junction creation in temporary directories, and unexpected System32 writes from MsMpEng.exe.
Article Details
- Attack Vectors
- A local, unprivileged user triggers Windows Defender remediation of a cloud-tagged file, then uses a batch OPLOCK to time the remediation write.
- The attacker replaces the working directory with a junction targeting C:\Windows\System32, redirecting Defender's privileged write to place an attacker-controlled binary there.
- The exploit activates the Storage Tiers Management COM server to execute the placed binary as SYSTEM.
- Defensive Notes
- Monitor for user-space processes enumerating HarddiskVolumeShadowCopy* devices, especially through NtQueryDirectoryObject.
- Alert on CfRegisterSyncRoot calls from untrusted processes or processes not recognized as cloud sync software.
- Monitor for junction or mount point reparse creation in %TEMP%, particularly after OPLOCK acquisition.
- Flag unexpected writes to C:\Windows\System32 originating from MsMpEng.exe.
- The article recommends disabling cloud-delivered protection only as a temporary measure on high-risk isolated systems, noting that it significantly degrades Defender's detection capability.
MITRE ATT&CK
CVE
People
Vendors
Products
DropboxAlert on CfRegisterSyncRoot from untrusted processes. Cloud Files sync root registration outside of known cloud sync software such as OneDrive or Dropbox is a strong indicator of this attack pattern.Microsoft OneDriveThe Windows Cloud Files API (CfApi.dll) provides the infrastructure for cloud sync providers such as OneDrive. It allows a process to register a directory as a sync root and create placeholder files lightweight stubsWindows 10any Windows system with Windows Defender enabled and the cldapi.dll component present which covers Windows 10, Windows 11, and Windows Server 2019 and later. The exploit functions with approximately 100%Windows 11The vulnerability was confirmed on Windows 11 25H2 Build 26200.8246 with real time protection fully enabled and may affect other versions of Windows as well.Windows DefenderA logic flaw in Windows Defender's file remediation path allows a standard user to redirect Defender's own restore write into C:\Windows\System32, resulting in elevated code execution. No administrative privileges, UACWindows ServerDefender enabled and the cldapi.dll component present which covers Windows 10, Windows 11, and Windows Server 2019 and later. The exploit functions with approximately 100% reliability even against systems with
Tools
BlueHammerAs of the time of writing, no patch exists for RedSun. Microsoft has not assigned a CVE or issued a fix. BlueHammer, the earlier exploit by the same researcher, was addressed as CVE-2026-33825 in April 2026 Patch .RedSunfunctional Windows local privilege escalation exploit publicly. The exploit, which now is being called as RedSun, targets a logic flaw in Windows Defender's file remediation path that allows a standard unprivileged