CISA Warns of Microsoft Defender BlueHammer Zero-Day Risk

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive to U.S. federal agencies, giving them just two weeks to address a newly identified zero-day vulnerability in Microsoft Defender, known as BlueHammer. The flaw, tracked as CVE-2026-33825, has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, signaling that it is already being actively used by attackers in real-world scenarios. With a severity rating of 7.8 out of 10, the vulnerability stems from insufficient access control within Defender, enabling attackers to escalate privileges locally and potentially gain deeper control over compromised systems.

The issue first came to light in early April when a researcher operating under the alias “Chaotic Eclipse” publicly disclosed the exploit, citing frustration with how vulnerability reports were handled. Rather than following coordinated disclosure norms, the researcher released details openly, along with proof-of-concept code, increasing the urgency for mitigation. Shortly after, two additional vulnerabilities RedSun and unDefend were also revealed, further intensifying concerns around Defender’s security posture across systems like Windows 10, Windows 11, and Windows Server.

Security experts at Huntress Labs have since confirmed that these vulnerabilities are not just theoretical risks but are actively being exploited as part of broader intrusion campaigns. Their findings indicate that attackers are leveraging the flaws alongside other tactics, including suspicious VPN access tied to infrastructure traced to multiple global regions, including Russia. This suggests coordinated and potentially sophisticated attack activity rather than isolated experimentation.