Microsoft Defender Antimalware Platform Local Privilege Escalation (BlueHammer)
A local privilege escalation flaw in Microsoft Defender Antimalware Platform caused by insufficient access-control granularity. An authorized local attacker can elevate privileges. Patched in April 2026 Patch Tuesday, added to the CISA KEV catalog on 2026-04-22, and confirmed by CISA in July 2026 as weaponized in ransomware attacks. Disclosed as a zero-day by researcher "Chaotic Eclipse" (aka Nightmare-Eclipse) alongside two sibling flaws — RedSun and UnDefend — as a protest of Microsoft's disclosure coordination.
- Vendor
- Microsoft
- Product
- Defender Antimalware Platform (versions 4.0.0.0 through before 4.18.26030.3011)
- CVSS
- 7.8
- EPSS (exploit probability)
- 0.4%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-33825 being exploited?
Yes. CISA added CVE-2026-33825 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. CISA marks it as known to be used in ransomware campaigns.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
What to do
US federal civilian agencies must remediate by (14 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-33825, tracked publicly as BlueHammer, is a local privilege escalation vulnerability in Microsoft Defender Antimalware Platform disclosed as a zero-day in April 2026 and patched the same month. It affects Defender Antimalware Platform builds from 4.0.0.0 through builds before 4.18.26030.3011. The flaw stems from insufficient granularity of access control: an authorized local attacker — one who already has some foothold on the system — can leverage it to elevate to a higher-privilege context. Not remote, not unauthenticated.
Timeline
- April 2026 — Researcher “Chaotic Eclipse” (aka Nightmare-Eclipse) publishes three Defender zero-days as protest disclosures: BlueHammer (LPE), RedSun (LPE), and UnDefend (definition-update DoS). Huntress observes BlueHammer exploitation from 2026-04-10.
- 2026-04-14 — Microsoft patches BlueHammer as CVE-2026-33825 in Patch Tuesday. RedSun and UnDefend remain unpatched at the time of Huntress’ April writeup.
- 2026-04-22 — CISA adds CVE-2026-33825 to the Known Exploited Vulnerabilities catalog. Federal civilian mitigation deadline: 2026-05-06.
- 2026-07-02 — CISA confirms the flaw was used in ransomware attacks, per The Hacker News. Ransomware family not publicly named at time of writing.
Sourcing
- NVD: CVE-2026-33825
- CISA KEV catalog: cisa.gov/known-exploited-vulnerabilities-catalog
- The Hacker News (April 2026): Three Microsoft Defender zero-days from Chaotic Eclipse
- The Hacker News (July 2026): ThreatsDay: CISA confirms ransomware use
Other Microsoft Defender CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-45498 Microsoft Defender Denial of Service Vulnerability | [ MEDIUM ] | 4.0 | 1.3% | |
| CVE-2026-41091 Microsoft Defender Link Following Vulnerability | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2022-44698 Microsoft Defender SmartScreen Security Feature Bypass Vulnerabilityransomware use | [ MEDIUM ] | 5.4 | 76.3% | |
| CVE-2021-1647 Microsoft Defender Remote Code Execution Vulnerability | [ HIGH ] | 7.8 | 39.7% |
