RedSun CVE-2026-33825 TieringEngineService.exe Binary Overwrite

Luís Marques@remotecodeexecution

•updated Jul 6, 2026•0•0•8

Detects file write, creation, or modification of C:\Windows\System32\TieringEngineService.exe by any process other than legitimate Windows servicing components. The RedSun exploit (CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object is subsequently invoked. Legitimate modification of this file is almost exclusively performed by TrustedInstaller during Windows servicing operations.