Microsoft Issues Out‑of‑Band Patches for Actively Exploited Defender Zero‑Days (UnDefend, RedSun)

Why It Matters

The Defender zero‑days expose a critical weakness in the default security layer of Windows, the operating system that powers the majority of corporate and government desktops. Active exploitation means attackers can achieve SYSTEM privileges or silently disable protection, paving the way for ransomware, data theft, or espionage. The incident also tests Microsoft’s ability to respond to zero‑day threats and may accelerate adoption of supplemental endpoint detection and response (EDR) solutions. For federal IT managers, the CISA directive creates a compliance deadline that could drive a wave of patching activity across thousands of agencies, potentially straining update pipelines and highlighting the need for better inventory and patch‑management tooling. In the broader market, the episode may influence procurement decisions, with organizations scrutinizing vendors’ vulnerability‑response timelines and considering diversified security stacks to mitigate single‑point‑of‑failure risks.

Key Takeaways

• Microsoft released Malware Protection Engine 1.1.26040.8 and Antimalware Platform 4.18.26040.7 to fix CVE‑2026‑41091 (privilege escalation, CVSS 7.8) and CVE‑2026‑45498 (DoS, CVSS 4.0).
• CISA added both CVEs to its Known Exploited Vulnerabilities catalog on May 20 and issued a Binding Operational Directive requiring federal agencies to patch by June 3.
• The flaws correspond to the RedSun and UnDefend variants of the BlueHammer exploit chain first observed in April 2026.
• Huntress documented a real‑world intrusion where attackers leveraged the chain after compromising a FortiGate VPN account.
• Microsoft’s default configuration auto‑updates definitions, but administrators must verify version numbers to confirm the out‑of‑band patches are applied.

Pulse Analysis

Microsoft’s rapid out‑of‑band response underscores the growing pressure on platform vendors to treat zero‑day exploitation as a crisis rather than a routine patch cycle. Historically, Microsoft’s Patch Tuesday cadence has been sufficient for most vulnerabilities, but the six‑week window between public exploitation of RedSun/UnDefend and remediation exposed a gap that adversaries were able to exploit at scale. The incident may push Microsoft to adopt a more aggressive “zero‑day emergency” framework, akin to the processes used by cloud providers for critical cloud‑service bugs.

From a market perspective, the episode could accelerate demand for third‑party EDR and XDR solutions that provide deeper telemetry and faster detection of novel exploit chains. Enterprises that have relied solely on Defender’s default settings may now reassess their layered‑defense strategies, especially in regulated sectors where a single breach can trigger severe compliance penalties. The CISA directive also highlights how government mandates can act as catalysts for broader industry patch adoption, potentially reducing the overall dwell time of such exploits.

Looking ahead, the RedSun and UnDefend disclosures raise questions about the completeness of Microsoft’s vulnerability‑disclosure pipeline. If additional, undisclosed flaws exist within the same exploit family, attackers could retain a foothold even after the current patches are applied. Stakeholders will be watching closely for any follow‑up advisories, and the incident may spur tighter coordination between independent security researchers, vendors, and agencies to avoid the prolonged exposure windows that have become increasingly intolerable in a threat‑rich environment.