CVE-2026-41091 RedSun | Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM 🔥 via Cloud Files API + NTFS junction trickery. Forces Defender to write malicious payloads to System32 with SYSTEM rights. ⚠️ Actively exploited in wild. CVSS 7.8. Patch: Defender Engine 1.1.26040.8. 🛡️ Educational PoC only.
Microsoft Defender Link Following Vulnerability - Local Privilege Escalation to NT AUTHORITY\SYSTEM
This repository contains a full working Proof of Concept (PoC) exploit for CVE-2026-41091, a critical local privilege escalation vulnerability in Microsoft Defender (Microsoft Malware Protection Engine). By exploiting improper link resolution (CWE-59), an authenticated low-privileged attacker can gain NT AUTHORITY\SYSTEM privileges.
The vulnerability, also known as "RedSun" or "SolarFlare", allows attackers to trick Microsoft Defender into writing arbitrary files to protected system locations with SYSTEM privileges using Cloud Files API (CfAPI) and NTFS junction points.
Note: This repository includes two versions:
basic_poc.cpp- Simplified algorithm demonstration (educational)full_poc.cpp- Complete working exploit with all features
| Category | Features |
|---|---|
| Exploitation | ✅ Local Privilege Escalation to SYSTEM ✅ Cloud Files API (CfAPI) Integration ✅ Cloud Placeholder Creation ✅ NTFS Junction Redirection |
| Techniques | ✅ Batch Oplock Abuse ✅ VSS Snapshot Detection ✅ EICAR Trigger ✅ COM Service Activation |
| Target | ✅ Microsoft Defender < 1.1.26040.8 ✅ Windows 10/11 ✅ Windows Server 2019/2022 |
| Usability | ✅ Detailed Logging ✅ Error Handling ✅ Random Directory Names ✅ Automatic Cleanup |
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-41091 |
| CVSS Score | 7.8 (High) |
| CVSS Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Attack Vector | Local |
| Privileges Required | Low |
| User Interaction | None |
| Impact | SYSTEM-level code execution |
| CISA KEV | ✅ Yes (actively exploited in the wild) |
| Patch Available | Microsoft Malware Protection Engine 1.1.26040.8 |
| Product | Affected Versions | Fixed Versions |
|---|---|---|
| Microsoft Malware Protection Engine | < 1.1.26040.8 | 1.1.26040.8+ |
| Microsoft Defender Antimalware Platform | < 4.18.26040.7 | 4.18.26040.7+ |
┌─────────────────────────────────────────────────────────────────────────────┐
│ SOLARFLARE EXPLOIT CHAIN │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ 1. Create Working Directory │
│ └─> %TEMP%\SF-XXXX\ │
│ │
│ 2. Trigger Defender with EICAR │
│ └─> Write reversed EICAR to bait file │
│ │
│ 3. Wait for VSS Snapshot │
│ └─> Detect Volume Shadow Copy creation │
│ │
│ 4. Create First Batch Oplock │
│ └─> FSCTL_REQUEST_BATCH_OPLOCK on bait file │
│ │
│ 5. Wait for Oplock Break │
│ └─> Acquire exclusive access │
│ │
│ 6. Rename Directory │
│ └─> Move original directory to .tmp │
│ │
│ 7. Register Cloud Sync Root │
│ └─> CfRegisterSyncRoot with Cloud Files API │
│ │
│ 8. Create Cloud Placeholder │
│ └─> CfCreatePlaceholders for bait file │
│ │
│ 9. Create Second Batch Oplock │
│ └─> FSCTL_REQUEST_BATCH_OPLOCK on cloud placeholder │
│ │
│ 10. Wait for Second Oplock Break │
│ └─> Acquire exclusive access │
│ │
│ 11. Rename Cloud Directory │
│ └─> Move cloud directory to .cloud.tmp │
│ │
│ 12. Create NTFS Junction to System32 │
│ └─> Redirect to C:\Windows\System32 │
│ │
│ 13. Copy Payload to System32 │
│ └─> Copy bait file to System32 as TieringEngineService.exe │
│ │
│ 14. Activate Service as SYSTEM │
│ └─> CoCreateInstance(StorageTiersManagement) │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
# Clone the repository
git clone https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit
cd CVE-2026-41091-PoC-Exploit
# Build using Visual Studio Developer Command Prompt
cl.exe /EHsc /std:c++17 full_poc.cpp /link cfapi.lib ntdll.lib
# Or build basic version
cl.exe /EHsc /std:c++17 basic_poc.cpp /link ntdll.lib
full_poc.exe
basic_poc.exe
CVE-2026-41091 SolarFlare PoC
===============================
by @tc4dy | CVSS 7.8
===============================