RedSun abuse of Windows Defender yields SYSTEM-level privilege escalation
RedSun (CVE‑2026‑41091) exploits a flaw in Windows Defender’s remediation workflow that rewrites quarantined files, letting an unprivileged user write arbitrary data to C:\Windows\System32 and execute code as NT AUTHORITY\SYSTEM. The technique leverages NTFS junction points, opportunistic locks, and volume shadow copies to hijack Defender’s SYSTEM‑privileged file operations.