Date: Mon, 06 Jul 2026 01:59:51 GMT
ID: 2073950021829980508

This should work in theory, can someone test if this blocks updates ?


Unrealisedd (@Unrealisedd)

Microsoft patched UnDefend (CVE-2026-45498) back in May but all they did was block one locking method. The actual root cause, permissive DACLs on Defender's signature files, is still wide open. Any standard user can freeze signature updates with a single CreateFileW call. That's not a fix.

Huge credit to @ChaoticEclipse0 for the original UnDefend research that inspired this. Their work exposed a fundamental design flaw in how Defender protects its own files and Microsoft's patch proved they didn't fully understand it.

PoC + full writeup: github.com/Unrealisedd/explo…



— https://nitter.net/Unrealisedd/status/2071556557079224483#m

Links:
  https://nitter.net/Unrealisedd/status/2071556557079224483#m
  https://github.com/Unrealisedd/exploitarium/tree/main/defender-signature-lock-bypass
