Microsoft Defender CVE-2026-33825 Exploited in Active Ransomware Campaigns

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog to confirm that ransomware groups are actively exploiting a high-severity privilege escalation vulnerability in Microsoft Defender. Tracked as CVE-2026-33825 and publicly referred to as BlueHammer, the security flaw allows local, low-privileged attackers to bypass Windows access controls and elevate their privileges to SYSTEM level, the highest administrative tier in the operating system. CISA’s June 29, 2026 update officially flags the flaw as being utilized within active ransomware campaigns. While Microsoft issued a patch for the vulnerability on April 14, 2026, security researchers had already observed active zero-day exploitation in the wild prior to the fix.

Mechanism of the BlueHammer Race Condition

The BlueHammer vulnerability stems from an architectural issue inside Microsoft Defender’s file-handling and update routines, specifically involving how the software validates local resources before executing operations with system-level permissions. Categorized under the Common Weakness Enumeration as CWE-1220 (Insufficient Granularity of Access Control), the flaw centers on a Time-of-Check to Time-of-Use (TOCTOU) race condition.

To exploit this behavior, an attacker must already have local access and low-privileged credentials on the targeted system. The exploit sequence is triggered during Microsoft Defender’s signature update workflow.

During this process, the security client creates a temporary volume shadow copy snapshot of the system. To freeze this process at a precise moment, the exploit abuses several native Windows components:

• The Windows Cloud Files API to pause operations.
• Opportunistic locks (oplocks) to hold files open.
• NTFS directory junctions and Object Manager symbolic links.

While the Microsoft Defender service (MsMpEng.exe) is suspended mid-task, the attacker swaps the target file paths. When the lock releases and Defender proceeds with the task, it reads from the redirected path—which points to a copy of the Security Account Manager (SAM) registry database located on a Volume Shadow Copy (VSS) snapshot—using its elevated privileges. This grants the low-privileged attacker direct access to credentials, allowing them to decrypt local password hashes.

To spawn the SYSTEM shell, the exploit utilizes the native SamiChangePasswordUser function to modify and subsequently restore password hashes during the escalation process. This leaves the system’s recorded password change timestamps unaltered, minimizing forensic indicators.

Leak and Initial Zero-Day Attacks

The vulnerability first emerged publicly on April 2, 2026, when a security researcher known by the pseudonyms Chaotic Eclipse and Nightmare Eclipse published fully functional proof-of-concept exploit code on GitHub. The researcher released the material without coordinated disclosure, stating it was a protest against the administrative and documentation standards used by the Microsoft Security Response Center (MSRC) to process bug reports.

Following the public release, cybersecurity firm Huntress Labs detected threat actors weaponizing the exploit as a zero-day in live systems. Security analysts observed “hands-on-keyboard” intrusion activity, where remote operators manually executed the commands to escalate privileges on compromised hosts before Microsoft could distribute a security update.

According to security analyst Will Dormann of Tharros, the exploit is structurally complex to weaponize but provides highly effective outcomes once executed. Dormann noted that gaining access to the SAM database allows attackers to dump credentials and fully compromise local administrative accounts.

Ongoing Exploitation and Mitigations

CISA initially added the BlueHammer vulnerability to its Known Exploited Vulnerabilities catalog on April 22, 2026, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their systems within a two-week window. The agency’s update on Monday, June 29, 2026, officially verified that ransomware campaigns are actively leveraging the flaw.

While Microsoft rolled out a patch for CVE-2026-33825 on April 14, 2026, as part of its monthly Patch Tuesday updates, the tech giant’s official advisory has not yet updated its internal status to confirm in-the-wild exploitation. The fix was addressed in Defender Antimalware Platform update version 4.18.26050.3011 (or later).

The security researcher behind the original leak has disclosed multiple other zero-day vulnerabilities in Windows and Microsoft Defender over the first half of 2026, including flaws named RoguePlanet, RedSun, GreenPlasma, MiniPlasma, YellowKey, and UnDefend. Microsoft addressed GreenPlasma, MiniPlasma, and YellowKey in its June 2026 security updates, but others remain unpatched. Security administrators are advised to ensure all Windows endpoints are updated past the April 2026 patch cycle to prevent local privilege escalation via the BlueHammer exploit chain.