--- title: New Microsoft Defender “RedSun” zero-day PoC grants... description: A researcher called 'Chaotic Eclipse' has released a second Microsoft Defender zero-day proof-of-concept exploit in two weeks, dubbed 'RedSun.' The local... canonical: https://daily.dev/posts/new-microsoft-defender-redsun-zero-day-poc-grants-system-privileges-uwklow0f7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privileges | daily.dev og:description: A researcher called 'Chaotic Eclipse' has released a second Microsoft Defender zero-day proof-of-concept exploit in two weeks, dubbed 'RedSun.' The local... og:url: https://daily.dev/posts/new-microsoft-defender-redsun-zero-day-poc-grants-system-privileges-uwklow0f7 og:image: https://api.daily.dev/og/posts/uWklow0F7.png og:image:alt: New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privileges og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privileges **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 1 upvotes · 0 comments ## Summary A researcher called 'Chaotic Eclipse' has released a second Microsoft Defender zero-day proof-of-concept exploit in two weeks, dubbed 'RedSun.' The local privilege escalation flaw abuses Windows Defender's cloud file handling behavior — when Defender detects a malicious file with a cloud tag, it rewrites the file to its original location, which the exploit leverages to overwrite system files and gain SYSTEM privileges. The exploit works on fully patched Windows 10, Windows 11, and Windows Server 2019 and later, confirmed by principal vulnerability analyst Will Dormann. The researcher published the PoC in protest over alleged mistreatment by Microsoft's Security Response Center during a prior vulnerability disclosure. Microsoft responded with a statement supporting coordinated vulnerability disclosure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges](https://daily.dev/posts/microsoft-defender-rogueplanet-zero-day-grants-system-privileges-ldyxflycj) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#windows](https://daily.dev/tags/windows), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/new-microsoft-defender-redsun-zero-day-poc-grants-system-privileges-uwklow0f7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privileges","url":"https://daily.dev/posts/new-microsoft-defender-redsun-zero-day-poc-grants-system-privileges-uwklow0f7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-microsoft-defender-redsun-zero-day-poc-grants-system-privileges-uwklow0f7"},"datePublished":"2026-04-16T20:23:22.956Z","dateModified":"2026-04-16T20:23:55.788Z","description":"A researcher called 'Chaotic Eclipse' has released a second Microsoft Defender zero-day proof-of-concept exploit in two weeks, dubbed 'RedSun.' The local...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3e7c2e082439864962ca6ef1f3adc15a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3e7c2e082439864962ca6ef1f3adc15a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-microsoft-defender-redsun-zero-day-poc-grants-system-privileges-uwklow0f7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"windows,zero-day","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privileges"}]} ```