Microsoft Defender double zero-day: RedSun and UnDefend actively exploited - patched May 21 2026
Microsoft pushed emergency patches on May 21 for two actively exploited Defender zero-days. RedSun escalates to SYSTEM via symbolic-link tricks. UnDefend silently disables signature updates. CISA added both to the Known Exploited Vulnerabilities list.
Published on