Microsoft warns of new Defender zero-days exploited in attacks

CVE-2026-41091, MS Defender local privilege escalation (LPE) flaw known as RedSun, and CVE-2026-45498 is known as UnDefend, a security flaw according to a security researcher known as “Nightmare Eclipse”.