Windows Defender BlueHammer flaw (CVE-2026-33825) used in attacks; fixed by Defender platform update
BlueHammer (CVE-2026-33825) lets someone already on a Windows PC use Microsoft Defender to gain full control. Attackers tried it in a real intrusion and CISA says ransomware gangs use it. Fixed 14 April; check Defender platform is 4.18.26030.3011 or newer.
Let Windows Update run, then open Windows Security, Settings, About, and confirm the Antimalware Client version is 4.18.26030.3011 or newer. Businesses should check their managed Defender platform version and review VPN logins for odd locations.
- Microsoft Defender Antimalware Platformfixed in 4.18.26030.3011 and later
What’s happening
BlueHammer is a flaw in Microsoft Defender, the antivirus built into Windows. Someone who already has a foothold on a computer can use it to gain full control of the machine. Exploit code was published on 2 April 2026, before any fix existed. Microsoft fixed it on 14 April as CVE-2026-33825, rated 7.8 out of 10. The fix arrives through the Defender Antimalware Platform update, version 4.18.26030.3011 or later, which Windows normally installs automatically. Huntress, a security firm, saw attackers try BlueHammer and two other Defender exploits, RedSun and UnDefend, in a real intrusion that began with a stolen VPN login. Huntress believes none of them worked in that case. CISA added CVE-2026-33825 to its list of flaws being used in attacks on 22 April and says ransomware gangs have used it. As of Huntress's 20 April report, RedSun and UnDefend had no fix; we have not confirmed their current status. The attacker needs access first, so this is a second-stage risk, not a way in.
- What
- Flaw
- Affects
- Microsoft Defender Antimalware Platform (Windows)
- Affected
- Microsoft Defender Antimalware Platform versions below 4.18.26030.3011
- Fixed in
- Microsoft Defender Antimalware Platform 4.18.26030.3011
- Since
- 2 Apr 2026
- Closed
- 22 Apr 2026
Timeline
- CISA added
CISA added CVE-2026-33825 to its list of flaws being used in attacks, noting use by ransomware gangs. Help Net Security reports the catalogue update on 23 April.
- Update
Huntress published its report on the intrusion. It believes none of the three exploits worked: BlueHammer did not extract credentials and RedSun did not overwrite its target file. It isolated the affected organisation. RedSun and UnDefend were still unpatched at the time.
- Wider attacks
The same researcher posted two more Defender exploits, RedSun and UnDefend, with no CVE and no fix mentioned. Huntress saw attackers try BlueHammer, RedSun and UnDefend in one intrusion that began with a stolen VPN login.
- New fixFixed
Microsoft fixed BlueHammer as CVE-2026-33825 in its April 2026 updates. The fix is delivered through the Defender Antimalware Platform update (version 4.18.26030.3011 or later, per the CISA listing).
- Wider attacks
Huntress saw suspected in-the-wild use of BlueHammer, when Defender quarantined a BlueHammer binary on a customer machine.
- Made publicNo fix yet
A researcher using the names Chaotic Eclipse and Nightmare Eclipse publicly released exploit code for BlueHammer, a Microsoft Defender flaw, with no fix available. Help Net Security reports the researcher said an attempt to report it to Microsoft went nowhere. Sources differ slightly on the release date (Huntress says 2 April, Help Net Security says 3 April).
Sources
- CVE-2026-33825 Microsoft Defender vulnerability (Security Update Guide)Microsoft MSRC · 14 Apr 2026
- Nightmare-Eclipse tooling intrusionHuntress · 20 Apr 2026
- Microsoft Defender zero-days exploitedHelp Net Security · 17 Apr 2026