TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Qualys Blog

Don’t Wait for a Patch. Mitigate RedSun Zero-Day Risk in Microsoft Defender Today

Mukesh Choudhary · 2026-04-22 · Read original ↗

ATT&CK techniques detected

3 predictions
T1068Exploitation for Privilege Escalation
85%
"don ’ t wait for a patch. mitigate redsun zero - day risk in microsoft defender today key takeaways redsun is a critical zero - day vulnerability in microsoft defender that allows low - privileged users to gain system access no patch is currently available, leaving all defender -…"
T1068Exploitation for Privilege Escalation
58%
"this blog walks through how qualys vmdr detects redsun across your environment and how trurisk eliminate enables teams to deploy targeted mitigations for measurable risk reduction, even without a vendor fix. try trurisk eliminate today to see how you can mitigate the redsun vulne…"
T1190Exploit Public-Facing Application
46%
"microsoft defender that allows a low - privileged user to gain nt authority \ system access by exploiting flaws in the remediation workflow. why is redsun considered critical? it combines low attack complexity, no required privileges, and broad exposure across windows systems run…"

Summary

Key Takeaways RedSun is a zero-day local privilege escalation (LPE) vulnerability in Microsoft Defender. It allows a low-privileged user to gain full SYSTEM-level access on Windows without any kernel exploit or administrator interaction.  What makes RedSun especially dangerous is that it weaponizes a trusted, always-on security component. Most enterprise environments have Defender running continuously, making the attack surface universal across […]