CISA orders feds to patch BlueHammer flaw exploited as zero-day

CVE-2026-33825 is a high-severity Microsoft Defender privilege escalation vulnerability that allows low-privileged local threat actors to gain SYSTEM permissions on unpatched devices by exploiting an insufficient granularity of access control weakness. The vulnerability was dubbed 'BlueHammer' by security researcher 'Chaotic Eclipse' who published proof-of-concept exploit code. Two additional related vulnerabilities were disclosed: RedSun (another privilege escalation flaw) and UnDefend (blocks Defender definition updates). Attacks showed evidence of hands-on-keyboard threat actor activity with suspicious FortiGate SSL VPN access from Russian IP addresses.