Microsoft’s Own Antivirus Just Became the Hacker’s Best Friend. Here’s What’s Being Done About It.

A disgruntled security researcher published exploits for Windows Defender out of spite. Six weeks later, they're being used in real attacks. Your antivirus is now a liability.

His name online is Nightmare Eclipse.

He is a security researcher who spent months responsibly reporting vulnerabilities in Microsoft Defender to Microsoft's Security Response Center — the team responsible for taking those reports seriously.

According to him, they didn't.

So on April 3, 2026, he published everything publicly. Three working exploits for Windows Defender. No warning. No coordinated disclosure. No patch in place.

He called them BlueHammer, RedSun, and UnDefend.

Six weeks later, real attackers are using them in real intrusions. Microsoft rushed out emergency patches on May 21, 2026 — patches that should have existed months earlier.

Huntress incident responders confirmed the first real-world use of the exploit chain in mid-April 2026 — an attacker entered through a compromised FortiGate VPN account, ran standard reconnaissance commands, then deployed the exploits in sequence.

The antivirus protecting your Windows machines has been actively exploited for six weeks.

What These Exploits Actually Do — And Why the Combination Is Terrifying

Each exploit does something different. Together, they form one of the most complete attack chains ever documented against a Windows endpoint.

BlueHammer (CVE-2026–33825) was the first to drop. It gives an attacker who already has a basic foothold on a machine — through a phishing email, a compromised download, or a stolen password — full SYSTEM-level privileges. Not administrator. SYSTEM. The highest level of access that exists on a Windows machine. Patched in April's Patch Tuesday. Already in CISA's Known Exploited Vulnerabilities catalog.

RedSun (CVE-2026–41091) is a link-following bug in the Malware Protection Engine — the core component that actually scans files for threats. An attacker tricks the engine into following a crafted symbolic link during a scan, gaining SYSTEM privileges through the scanner itself.

UnDefend (CVE-2026–45498) is the one that should worry you most. It puts Defender into a denial-of-service state — making the endpoint appear healthy and fully protected while Defender becomes completely incapable of detecting anything new.

Read that again.

UnDefend makes your antivirus look like it's working. Your dashboard shows green. Your security team sees no alerts. But Defender has stopped processing new threat signatures entirely — meaning any malware deployed after UnDefend runs is invisible to it.

The attack sequence is: BlueHammer gets SYSTEM access, RedSun reinforces it through a different code path, UnDefend blinds the antivirus — and then attackers deploy ransomware, exfiltrate data, or move laterally through your network while your security tools report everything as normal.

The Researcher Behind It All — And Why This Happened

The story of how these exploits became public is as important as the exploits themselves.

Nightmare Eclipse — also known as Chaos Eclipse — spent months working through Microsoft's official vulnerability disclosure process. He reported flaws. He waited. He says Microsoft's response was to threaten him rather than fix the vulnerabilities.

According to the researcher, Microsoft representatives threatened him and promised to "ruin his life." He published the exploits as a direct protest against how Microsoft's Security Response Center treats security researchers.

Whether his account is entirely accurate is something only Microsoft and he know. What is not disputed is the outcome: three working exploits for Windows Defender were published publicly, with no coordinated patch, and attackers began using them within weeks.

After Microsoft patched the flaws on May 21 and had his GitHub account taken down, Nightmare Eclipse moved to GitLab and confirmed publicly that CVE-2026–45498 is UnDefend and CVE-2026–41091 is RedSun. He ended his post with a direct message to Microsoft: "Mark this date July 14th. I will make sure your bones are shattered that day."

July 14 is 45 days away.

The security community is watching.

The Six-Week Window That Exposed Every Windows Machine

Here is the timeline that should be part of every post-incident review happening right now.

April 3: Nightmare Eclipse publishes BlueHammer, RedSun, and UnDefend publicly. No patches exist for RedSun or UnDefend.

Mid-April: Huntress documents the first confirmed real-world intrusion using the exploit chain. An attacker enters through a compromised VPN account and deploys the exploits in sequence.

April 14: Microsoft patches BlueHammer in Patch Tuesday. RedSun and UnDefend still have no fix.

May 21: Microsoft releases emergency out-of-band patches for RedSun and UnDefend — six weeks after public disclosure, weeks after confirmed exploitation.

May 21: CISA adds both CVEs to its Known Exploited Vulnerabilities catalog, mandating that federal agencies patch by June 3, 2026.

Six weeks. That is how long attackers had working, public exploits for Windows Defender with no patch available. Six weeks during which every unpatched Windows machine running Defender was potentially vulnerable to a complete SYSTEM-level compromise with antivirus silently disabled.

What You Need to Check Right Now

The good news is that Microsoft has patched all three vulnerabilities. The bad news is that patching requires action — and many organizations running enterprise Windows environments are not on automatic update schedules.

Check your Microsoft Defender platform version immediately.

You need Microsoft Defender Antimalware Platform version 4.18.26040.7 or later — and Malware Protection Engine version 1.1.26040.8 or later. Open Windows Security on any endpoint, go to Virus & threat protection → Protection updates → About, and confirm the versions. If you are below these numbers, you are still vulnerable.

Check your Malware Protection Engine version across all endpoints.

CVE-2026–41091 and CVE-2026–45584 affect Microsoft Malware Protection Engine v1.26030.3008 and earlier — fixed in v1.1.26040.8. CVE-2026–45498 affects Microsoft Defender Antimalware Platform — fixed in v4.18.26040.7.

For most organizations with automatic updates enabled, Microsoft Defender updates itself without requiring a system restart. But enterprise environments that manage updates through WSUS, SCCM, or Intune policies may have update deferrals in place that are blocking these patches from deploying.

Check your endpoint management console. Confirm that Defender definition and engine updates are not being deferred on any managed device.

Look for signs of prior compromise in the six-week window.

Patching closes the vulnerability. It does not tell you whether someone was in your environment between April 3 and May 21.

Review your endpoint detection logs for any unusual SYSTEM-level process activity during that period. Look for the reconnaissance pattern Huntress documented: whoami /priv, cmdkey /list, net group commands run in sequence from a low-privilege account. These are the fingerprints of the exploit chain being deployed.

If you use a SIEM, run a query for those commands executed within a 5-minute window from the same host between April 3 and May 21. If that query returns results, you have an incident response situation.

The Deeper Problem: What Happens When Antivirus Becomes the Attack Surface

I want to step back from the technical checklist for a moment, because the Nightmare Eclipse story reveals something important about how enterprise security is structured in 2026.

Every Windows machine in your organization trusts Microsoft Defender completely. It runs at kernel level. It has access to every file, every process, every system call. It operates with the highest privileges available because it needs those privileges to do its job.

That trust is exactly what makes it a target.

When a vulnerability exists in the Malware Protection Engine, it is not just any vulnerability. It is a vulnerability in the component that every other security layer on the machine assumes is working correctly. Your EDR solution reports back to Defender's telemetry infrastructure. Your threat hunting platform correlates Defender alerts. Your security operations center looks at Defender dashboards.

UnDefend's genius — if you can call it that — is that it does not disable Defender visibly. It makes Defender appear healthy while removing its ability to detect anything new. The green checkmark stays green. The dashboard stays clean. The alert feed stays quiet.

This is the attack that security teams have the hardest time finding: not the loud breach, but the silent one.

The Hardware Layer That Doesn't Rely on Defender

There is a lesson in the Nightmare Eclipse story that goes beyond patch management.

Defending against these exploits requires security outside the endpoint. Network detection, identity controls, behavioral detection, and response capabilities can operate independently of the compromised system.

This is the architectural point that matters for every IT manager reading this: your network perimeter should not rely on endpoint antivirus as its primary detection layer.

A next-generation firewall with behavioral analytics and intrusion prevention can detect anomalous traffic patterns — unusual outbound connections, lateral movement between internal segments, command-and-control callbacks — regardless of what is happening on the endpoint. It sees the network, not the machine. UnDefend cannot blind it.

In the confirmed Huntress intrusion, the attacker entered through a compromised FortiGate VPN account. That detail matters: the entry point was not the Defender exploit. The Defender exploit came after initial access. A properly configured FortiGate with behavioral analytics and Conditional Access policies might have flagged the unusual VPN authentication before the exploit chain was ever deployed.

The perimeter layer and the endpoint layer are not redundant. They are complementary. When one is compromised, the other should still be watching.

If your network hardware is running on outdated firmware or an expired threat subscription, it is not providing the detection layer it was designed to provide. At Jazz Cyber Shield, we carry authorized Fortinet, Cisco, SonicWall, and WatchGuard hardware — all with valid manufacturer licensing and active threat subscription support. Every device is sourced through official channels, which means every device receives the signature updates that matter when an exploit chain like this lands.

July 14

The patches are out. The immediate vulnerability is closed — for organizations that have applied the updates.

But the Nightmare Eclipse story is not over.

He has promised a new release on July 14. He has confirmed he is still working. He has demonstrated, three times, that he can identify and weaponize vulnerabilities in core Windows security components before Microsoft patches them.

Whether his next release affects Defender, BitLocker, the Windows kernel, or something else entirely — nobody knows. What is known is that the six-week gap between BlueHammer's public release and Microsoft's patch for RedSun and UnDefend represents a template for how this kind of disclosure causes maximum damage.

The organizations that survived the April–May window without a confirmed breach were not necessarily better protected. Many of them were simply lucky — they had not been targeted yet.

Luck is not a security strategy.

Check your Defender version. Audit your VPN access logs for the six-week window. Confirm your network hardware is running current threat signatures.

And mark July 14 on your calendar.

For enterprise network hardware with valid manufacturer licensing and active threat subscriptions — Fortinet, Cisco, SonicWall, WatchGuard — visit Jazz Cyber Shield. USA-based authorized reseller, fast nationwide shipping.

→ jazzcybershield.com