Microsoft Defender Flaws Exploited on Windows, Two Left Unpatched

A security researcher (Chaotic Eclipse / Nightmare-Eclipse) published zero-day exploits for three Microsoft Defender flaws: BlueHammer (patched) abuses Defender definition updates and opportunistic locks to escalate local accounts to SYSTEM; RedSun (unpatched) uses the Cloud Files API and oplocks to overwrite System32 files for SYSTEM access across Windows 10/11 and several Server versions; and UnDefend (unpatched) can deny Microsoft Defender definition updates or disable Defender during major platform updates. Microsoft has patched BlueHammer but RedSun and UnDefend remain unpatched, and organizations are advised to monitor Defender activity until fixes are released.