UnDefend: Defender Update-Pipeline DoS (CVE-2026-45498)

Summary

UnDefend is the third Nightmare-Eclipse cluster tool — a denial-of-service weapon against Microsoft Defender published in April 2026. Unlike BlueHammer and RedSun, it requires no privilege escalation primitives: a standard local user can disrupt Defender's ability to update signatures or, in aggressive mode, disable the engine during major platform update cycles. Microsoft assigned CVE-2026-45498 and patched in Defender Antimalware Platform 4.18.26040.7 (May 2026 OOB, engine 1.1.26040.8). CISA KEV and confirmed in-the-wild exploitation followed.

The PoC README describes two modes: passive blocks all signature updates so new Microsoft threat intelligence never reaches the host; aggressive targets complete Defender disablement when a major platform update (MsMpEng.exe and related binaries) is pending — passive is the default because platform updates are infrequent. The researcher also claims unpublished code can spoof Defender health telemetry (MSFT_MpComputerStatus / Intune-visible "protected" state) while the product is degraded — that component was intentionally withheld from release.

Huntress documented UnDefend deployed alongside RedSun in live intrusions: freeze detection baseline, then escalate privileges. OFFSITE.DARK indexes the public PoC and defensive analysis only.

Technical Details

UnDefend is structurally simpler than junction-based LPE siblings. Public analysis (nefariousplan.com, CSA) describes four independent locking mechanisms in ~450 lines of C++ — any one can succeed if others fail. The tool uses longstanding Windows file-locking primitives to hold exclusive locks on paths Defender must write during update, causing silent degradation rather than crash loops.

Operational pairing in attack chains

Defender Event ID and SCCM/Intune health checks that rely on WMI MSFT_MpComputerStatus without corroborating behavioral telemetry are insufficient when spoofing techniques exist — even though the full spoofing PoC was not published.

CVE

Impact

• Defense evasion — endpoints run with outdated signatures while appearing operationally normal to update-dependent workflows.
• Persistence enabler — subsequent malware faces weakened static detection until updates succeed or Tamper Protection intervenes.
• No elevation required — any compromised standard user can attempt disruption without prior admin access.
• Enterprise blind spots — compliance dashboards showing green Defender status may not reflect degraded protection if health telemetry is spoofed (unpublished technique; researcher-confirmed).

Mitigation

1. Deploy Defender platform ≥ 4.18.26040.7 and verify engine ≥ 1.1.26040.8 enterprise-wide.
2. Enable Tamper Protection and EDR block mode so cloud-delivered rules can fire even when local signature refresh fails.
3. Alert on repeated error 80070643 across multiple endpoints simultaneously (possible coordinated UnDefend deployment).
4. Correlate WMI health status with behavioral signals: failed signature age, MpSigStub.exe lock failures, anomalous exclusive handles on Defender data directories.
5. Treat UnDefend indicators as precursor activity — isolate and hunt for cluster LPE tools (RedSun, RoguePlanet) on affected hosts.

Sources

• Project Nightcrawler — NightmareEclipse/UnDefend (primary PoC source)
• Church of Malware git — Nightmare_Eclipse/UnDefend (historical mirror)
• Microsoft MSRC — CVE-2026-45498
• SecurityWeek — UnDefend and RedSun OOB patches
• CSA Research — Defender triple zero-day note
• nefariousplan.com — UnDefend analysis
• OFFSITE.DARK — RoguePlanet cluster index