Researchers warn Microsoft Defender vulnerability is already being exploited

Researchers disclosed a Microsoft Defender flaw dubbed Red Sun that can let specially tagged files be restored or rewritten in ways that may overwrite system files.

The issue could enable protection bypass or privilege escalation, which is especially concerning because Defender is built into Windows and widely deployed.

The researcher says proof-of-concept code exists and that exploitation attempts may already be happening in the wild.

The vulnerability is tracked as CVE-2026-33825, and Microsoft and the Microsoft Security Response Center are involved in the response.