{"id":"defender-bluehammer-privilege-escalation-apr-2026","category":"patch","status":"closed","title":"Windows Defender BlueHammer flaw (CVE-2026-33825) used in attacks; fixed by Defender platform update","tldr":"BlueHammer (CVE-2026-33825) lets someone already on a Windows PC use Microsoft Defender to gain full control. Attackers tried it in a real intrusion and CISA says ransomware gangs use it. Fixed 14 April; check Defender platform is 4.18.26030.3011 or newer.","summary":"BlueHammer is a flaw in Microsoft Defender, the antivirus built into Windows. Someone who already has a foothold on a computer can use it to gain full control of the machine. Exploit code was published on 2 April 2026, before any fix existed. Microsoft fixed it on 14 April as CVE-2026-33825, rated 7.8 out of 10. The fix arrives through the Defender Antimalware Platform update, version 4.18.26030.3011 or later, which Windows normally installs automatically. Huntress, a security firm, saw attackers try BlueHammer and two other Defender exploits, RedSun and UnDefend, in a real intrusion that began with a stolen VPN login. Huntress believes none of them worked in that case. CISA added CVE-2026-33825 to its list of flaws being used in attacks on 22 April and says ransomware gangs have used it. As of Huntress's 20 April report, RedSun and UnDefend had no fix; we have not confirmed their current status. The attacker needs access first, so this is a second-stage risk, not a way in.","action":"Let Windows Update run, then open Windows Security, Settings, About, and confirm the Antimalware Client version is 4.18.26030.3011 or newer. Businesses should check their managed Defender platform version and review VPN logins for odd locations.","product":"Microsoft Defender Antimalware Platform (Windows)","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-33825"],"tags":["microsoft","windows","defender","bluehammer","privilege-escalation","ransomware","exploited","cisa-kev"],"affected":["Microsoft Defender Antimalware Platform versions below 4.18.26030.3011"],"fixed":["Microsoft Defender Antimalware Platform 4.18.26030.3011"],"matches":[{"platform":"windows","app":"Microsoft Defender Antimalware Platform","bundle":"","fixed":"4.18.26030.3011"}],"sources":[{"kind":"advisory","title":"CVE-2026-33825 Microsoft Defender vulnerability (Security Update Guide)","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825","by":"Microsoft MSRC","date":"2026-04-14"},{"kind":"research","title":"Nightmare-Eclipse tooling intrusion","url":"https://www.huntress.com/blog/nightmare-eclipse-intrusion","by":"Huntress","date":"2026-04-20"},{"kind":"news","title":"Microsoft Defender zero-days exploited","url":"https://www.helpnetsecurity.com/2026/04/17/microsoft-defender-zero-days-exploited/","by":"Help Net Security","date":"2026-04-17"}],"started":"2026-04-02","closed":"2026-04-22","created":"2026-11-03T21:30:05.525Z","updated":"2026-11-03T21:30:05.525Z","cve_notes":[{"cve":"CVE-2026-33825","name":"Privilege escalation in Microsoft Defender (BlueHammer)","what":"An access-control weakness in Microsoft Defender, nicknamed BlueHammer, that lets an attacker who already has a foothold on a Windows computer raise their privileges and take full control; Huntress describes it as a timing flaw in Defender's signature update that can expose the stored password database.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-04-22","added":"2026-11-03T21:28:26.316Z","kind":"cisa-added","text":"CISA added CVE-2026-33825 to its list of flaws being used in attacks, noting use by ransomware gangs. Help Net Security reports the catalogue update on 23 April.","url":"https://www.helpnetsecurity.com/2026/04/17/microsoft-defender-zero-days-exploited/","by":"CISA","patch":null},{"at":"2026-04-20","added":"2026-11-03T21:28:26.316Z","kind":"other","text":"Huntress published its report on the intrusion. It believes none of the three exploits worked: BlueHammer did not extract credentials and RedSun did not overwrite its target file. It isolated the affected organisation. RedSun and UnDefend were still unpatched at the time.","url":"https://www.huntress.com/blog/nightmare-eclipse-intrusion","by":"Huntress","patch":null},{"at":"2026-04-16","added":"2026-11-03T21:28:26.316Z","kind":"wider-attacks","text":"The same researcher posted two more Defender exploits, RedSun and UnDefend, with no CVE and no fix mentioned. Huntress saw attackers try BlueHammer, RedSun and UnDefend in one intrusion that began with a stolen VPN login.","url":"https://www.helpnetsecurity.com/2026/04/17/microsoft-defender-zero-days-exploited/","by":"Help Net Security","patch":null},{"at":"2026-04-14","added":"2026-11-03T21:28:26.316Z","kind":"new-fix","text":"Microsoft fixed BlueHammer as CVE-2026-33825 in its April 2026 updates. The fix is delivered through the Defender Antimalware Platform update (version 4.18.26030.3011 or later, per the CISA listing).","url":"https://www.helpnetsecurity.com/2026/04/17/microsoft-defender-zero-days-exploited/","by":"Help Net Security","patch":"patched"},{"at":"2026-04-10","added":"2026-11-03T21:28:26.316Z","kind":"wider-attacks","text":"Huntress saw suspected in-the-wild use of BlueHammer, when Defender quarantined a BlueHammer binary on a customer machine.","url":"https://www.huntress.com/blog/nightmare-eclipse-intrusion","by":"Huntress","patch":null},{"at":"2026-04-02","added":"2026-11-03T21:28:26.316Z","kind":"disclosed","text":"A researcher using the names Chaotic Eclipse and Nightmare Eclipse publicly released exploit code for BlueHammer, a Microsoft Defender flaw, with no fix available. Help Net Security reports the researcher said an attempt to report it to Microsoft went nowhere. Sources differ slightly on the release date (Huntress says 2 April, Help Net Security says 3 April).","url":"https://www.huntress.com/blog/nightmare-eclipse-intrusion","by":"Huntress","patch":"none"}],"url":"https://hard.fyi/live/defender-bluehammer-privilege-escalation-apr-2026/","json":"https://hard.fyi/api/live?id=defender-bluehammer-privilege-escalation-apr-2026"}