BlueHammer CVE-2026-33825 Windows Defender LPE

Overview#

On April 2, 2026, a researcher under the alias Nightmare-Eclipse (also known as Chaotic Eclipse) published a working proof-of-concept exploit on GitHub targeting Microsoft Defender Antivirus. The BlueHammer exploit demonstrated local privilege escalation to SYSTEM on fully patched Windows 10 and Windows 11 systems. The researcher stated the release was a direct protest against Microsoft’s Security Response Center (MSRC) over its handling of the disclosure process.

Microsoft patched the vulnerability as CVE-2026-33825 on April 14, 2026 as part of the April 2026 Patch Tuesday cycle. That release addressed 163 CVEs in total. CISA added CVE-2026-33825 to its Known Exploited Vulnerabilities catalog on April 22, 2026 and set a remediation deadline of May 6, 2026 for all Federal Civilian Executive Branch agencies.

If your environment runs cPanel or WHM in addition to Windows systems, see our separate analysis of CVE-2026-41940 the critical cPanel and WHM authentication bypass, which was also actively exploited around the same period.

Quick Facts#

CVE ID: CVE-2026-33825

Alias: BlueHammer

CVSS v3.1 Score: 7.8 (High)

CVSS Vector: AV/AC/PR/UI/S/C/I/A

CWE: CWE-1220 (Insufficient Granularity of Access Control)

Affected: Windows 10 and Windows 11 (all editions, fully patched)

PoC Released: April 2, 2026 (zero-day, before any patch)

Patch Released: April 14, 2026 (April 2026 Patch Tuesday)

Patched Platform Version: 4.18.26050.3011 or later

CISA KEV Added: April 22, 2026

CISA KEV Deadline: May 6, 2026

In-the-wild exploitation: Confirmed from approximately April 10, 2026

Root Cause#

The vulnerability is a time-of-check to time-of-use (TOCTOU) race condition in Windows Defender’s threat remediation engine. When Defender detects a malicious file and starts cleanup it checks the target file path at one point in time and performs the privileged file operation slightly later. Between those two moments there is a measurable window where an attacker can swap out the filesystem path without Defender re-validating it.

The remediation engine runs as SYSTEM and does not re-validate path integrity before the write. Anything placed at the redirected path gets written with full SYSTEM privileges. This turns a race condition into a reliable arbitrary file write primitive.

Exploit Chain#

Stage 1 - Trigger a Defender Detection#

The attacker drops a file into a world-writable directory such as %TEMP% or %LOCALAPPDATA% that matches a known Defender signature. An EICAR test string is sufficient. No actual malware is required. Defender’s real-time protection engine detects the file and queues it for remediation.

Stage 2 - Pause Remediation with an Oplock#

Before Defender opens a file handle on the target the exploit places a batch opportunistic lock (oplock) on the file using NtFsControlFile with FSCTL_REQUEST_BATCH_OPLOCK. An oplock is a legitimate Windows kernel mechanism that pauses I/O on a file and delivers a break notification to the requesting process. Defender’s file-open call blocks inside the kernel and holds the race window open for as long as the attacker wants.

Stage 3 - NTFS Junction Swap#

While Defender is suspended the exploit deletes the original staging directory and replaces it with an NTFS junction point redirecting the path to C:\Windows\System32. The attacker positions a payload DLL at the target filename inside System32 before releasing the oplock.

Stage 4 - Arbitrary Write and SYSTEM Execution#

The oplock is released. Defender resumes and follows the redirected path, writing into C:\Windows\System32 under its own SYSTEM privileges. A standard DLL hijack against a SYSTEM service then executes the payload. The full chain from triggering the detection to achieving SYSTEM takes under two seconds and requires no interaction from any other user.

Nightmare-Eclipse disclosed two additional vulnerabilities alongside BlueHammer. RedSun attacks Defender’s handling of cloud-tagged files to overwrite system paths via the Windows Cloud Files API. UnDefend disrupts Defender’s update mechanism and gradually weakens its protection over time. Both use a similar oplock and junction primitive.

As of May 5, 2026 neither RedSun nor UnDefend has a CVE identifier or a Microsoft patch. Exploitation of both was first observed in the wild on April 16, 2026. Huntress observed all three exploits used together in a live intrusion where initial access came through a compromised FortiGate SSL VPN account.

How to Check Your Patch Status#

Defender platform updates ship through the Defender engine update channel independently of OS cumulative updates. Run the following in an elevated PowerShell session:

Get-MpComputerStatus | Select-Object AMEngineVersion, AMProductVersion, AntivirusSignatureLastUpdated

The AMProductVersion field must be 4.18.26050.3011 or later. If it is lower the system is still vulnerable.

How to Patch#

Step 1 - Force a Defender engine update:

Update-MpSignature -UpdateSource MicrosoftUpdateServer

Step 2 - Confirm the updated version:

Get-MpComputerStatus | Select-Object AMEngineVersion, AMProductVersion

Step 3 - If Update-MpSignature is blocked by policy trigger Windows Update directly:

UsoClient StartScan
UsoClient StartDownload
UsoClient StartInstall

Step 4 - Check for a pending reboot:

(New-Object -ComObject Microsoft.Update.SystemInfo).RebootRequired

A result of True means the update requires a reboot to fully apply.

Temporary Mitigation if You Cannot Patch Immediately#

These are stop-gap measures only. Apply the patch as soon as possible.

Disable real-time protection via Group Policy: Set Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection > Turn off real-time protection to Enabled. This closes the race window but removes active malware scanning entirely.

Restrict local interactive access: Exploitation requires local code execution with at least low-privilege access. Limiting interactive logon and RDP access reduces the practical attack surface.

Enable ASR rule for driver abuse: ASR rule GUID 56a863a9-875e-4185-98a7-b882c64b5ce5 can interrupt some NTFS junction abuse chains. Enable in audit mode first to measure impact before switching to block mode.

Detection#

Look for a Defender detection event followed immediately by unusual junction or symlink activity in the same process tree.

Event Log#

Check the Microsoft-Windows-Windows Defender/Operational log. A detection event (Event ID 1116) with no corresponding remediation action (Event ID 1117) within a few seconds may indicate the remediation was interrupted by an oplock.

Sysmon Rule#

Any file creation event where MsMpEng.exe writes into System32 outside of its own update directory is anomalous:

<RuleGroup name="BlueHammer IOC" groupRelation="and">
  <FileCreate onmatch="include">
    <TargetFilename condition="contains">\Windows\System32\</TargetFilename>
    <Image condition="is">C:\ProgramData\Microsoft\Windows Defender\Platform\MsMpEng.exe</Image>
  </FileCreate>
</RuleGroup>

Timeline#

April 2, 2026 - Nightmare-Eclipse publishes working BlueHammer PoC on GitHub

April 7, 2026 - Widespread media coverage; security community names it BlueHammer

April 10, 2026 - Earliest confirmed in-the-wild BlueHammer exploitation (Huntress)

April 14, 2026 - Microsoft patches CVE-2026-33825 in April 2026 Patch Tuesday (163 CVEs total)

April 16, 2026 - RedSun and UnDefend first observed exploited in the wild

April 22, 2026 - CISA adds CVE-2026-33825 to the Known Exploited Vulnerabilities catalog

May 6, 2026 - CISA deadline for all FCEB agencies to apply the patch

References#

Microsoft Security Response Center - CVE-2026-33825 Advisory

CISA Known Exploited Vulnerabilities Catalog - CVE-2026-33825

Picus Security - BlueHammer and RedSun Technical Analysis

BleepingComputer - CISA Orders Feds to Patch BlueHammer Flaw

Huntress - Nightmare-Eclipse Tooling Seen in Real-World Intrusion

Field Effect - Microsoft April 2026 Patch Tuesday

NVD - CVE-2026-33825 Detail

SecurityWeek - Windows Defender Vulnerability Exploited as Zero-Day

Authored by Jacob Strix, CEO and Security Researcher at Egnworks.