Windows Defender's Own Engine Weaponized: Three Zero-Days Put SYSTEM Privileges in Attacker Hands
A researcher's protest disclosure turned Microsoft Defender's remediation engine into an attack vector, with two of three zero-days remaining unpatched as ransomware actors move in.
Overview
A security researcher’s protest disclosure in early April 2026 has turned Windows Defender — the built-in antivirus trusted by more than a billion Windows devices — into an instrument of attack. Three separate zero-day vulnerabilities targeting Defender’s own remediation engine have surfaced within a 13-day window, with active in-the-wild exploitation confirmed and, as of late April, two of the three flaws still carrying no patch from Microsoft.
The first vulnerability, tracked as CVE-2026-33825 and carrying a CVSS score of 7.8, is a local privilege escalation flaw rooted in a time-of-check to time-of-use (TOCTOU) race condition in Defender’s threat remediation engine. A researcher operating under the handle “Chaotic Eclipse” published working proof-of-concept code for the exploit — dubbed BlueHammer — on April 3, citing frustration with Microsoft’s Security Response Center over its handling of the coordinated disclosure process. That decision put a functional escalation tool in public hands before any patch existed.
What We Know
BlueHammer works by placing a file that triggers a Defender detection, then using a batch opportunistic lock (oplock) to freeze Defender’s file operation at a critical juncture. During that pause, an attacker redirects Defender’s pending write — which runs as NT AUTHORITY\SYSTEM — through an NTFS junction toward a target directory of their choosing. The technique requires only a standard user account and no interaction from the victim, allowing any local user to escalate fully to SYSTEM privileges. Affected systems span Windows 10, Windows 11, and Windows Server 2016 through 2025 running pre-April 2026 Defender platform versions.
Chaotic Eclipse also disclosed two companion techniques: RedSun, which chains oplocks and junctions against Defender’s cloud file rollback path to achieve the same SYSTEM-level file write, and UnDefend, which attacks Defender’s signature update mechanism by locking definition files before the software can consume them — effectively degrading endpoint protection without triggering a visible alert. Microsoft’s April 2026 Patch Tuesday addressed BlueHammer; RedSun and UnDefend remain unpatched.
SecurityWeek confirmed that the first attacks exploiting CVE-2026-33825 were observed on April 10 — four days before the patch landed — with a second wave of activity on April 16. Huntress’s Security Operations Center identified compromised environments accessed through FortiGate SSL VPN, with attacker infrastructure geolocated to Russia and other regions. Staged binaries appeared in low-privilege user directories such as Pictures and Downloads, with filenames designed to blend in. Post-exploitation activity showed evidence of hands-on-keyboard reconnaissance operations, indicating deliberate intrusions rather than automated spray activity. Huntress also noted that some threat actors “were not familiar with how the Defender exploits worked and were unsuccessful in their attempts”, suggesting the public proof-of-concept drew in opportunistic actors of varying capability.
On April 22, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-33825 to its Known Exploited Vulnerabilities catalog, setting a May 7 deadline for Federal Civilian Executive Branch agencies to apply patches. CISA noted that “this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.”
Microsoft’s April 2026 Patch Tuesday addressed 163 CVEs in total, with BlueHammer resolved in Defender Antimalware Platform version 4.18.26030.3011 and later. Users can verify their current platform version through Windows Security settings and trigger a manual definition update to receive the fix.
What We Don’t Know
Several material questions remain open. Microsoft has not publicly acknowledged RedSun or UnDefend as distinct CVEs, nor provided a patch timeline for either technique. The scope of exploitation tied specifically to CVE-2026-33825 has not been quantified — Huntress’s observations reflect incidents reported through their managed detection and response service, not a census of all affected organizations.
The identity and organizational affiliation of “Chaotic Eclipse” have not been disclosed. The researcher’s stated grievance — that Microsoft mishandled coordinated disclosure — has not been publicly addressed by Microsoft’s Security Response Center, leaving unanswered whether the public drop of a working exploit before any patch existed violated any agreed embargo or whether no such agreement was in place.
It is also unclear whether the observed intrusions represent a targeted campaign exploiting BlueHammer specifically, or opportunistic threat actors incorporating the public proof-of-concept into existing toolchains. The infrastructure overlap with Russian-geolocated servers is suggestive but falls short of formal attribution to any named threat group.
For enterprise defenders, the more pressing uncertainty is operational: with RedSun and UnDefend unpatched and functionally equivalent in impact to BlueHammer, applying April’s Patch Tuesday update closes only one of three known avenues through which a standard user can obtain SYSTEM privileges by turning Defender’s own cleanup logic against itself.