BlueHammer Windows Zero-Day Local Privilege Escalation to SYSTEM via TOCTOU Race Condition and Path Confusion
BlueHammer Windows Zero-Day Local Privilege Escalation to (TL-2026-0329), also tracked as BlueHammer, is a high-severity zero-day vulnerability scored CVSS 7.8, first published 2026-04-07. It has no confirmed attribution, affects Microsoft Windows 11, maps to 12 MITRE ATT&CK techniques (T1003, T1036, T1068), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-0329
- Threat ID
- TL-2026-0329
- Also known as
- BlueHammer, BlueHammer Zero-Day, BlueHammer LPE
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- ZERO_DAY
- First published
- 2026-04-07
- Last reviewed
- 2026-04-07
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, financial, healthcare, critical-infrastructure, technology, defense, energy
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in BlueHammer Windows Zero-Day Local Privilege Escalation to
Malware and tooling: BlueHammer
BlueHammer is an unpatched Windows local privilege escalation zero-day that exploits a TOCTOU race condition in Windows Defender's signature update process combined with path confusion via junction swapping to gain access to the SAM database and escalate to NT AUTHORITY\SYSTEM. A functional PoC was publicly leaked on GitHub on April 3, 2026 by researcher Nightmare-Eclipse after a disclosure dispute with Microsoft MSRC. No CVE has been assigned and no patch is available.
How BlueHammer Windows Zero-Day Local Privilege Escalation to works
BlueHammer is a sophisticated local privilege escalation (LPE) zero-day exploit targeting the Windows Defender signature update mechanism. The vulnerability chains a Time-of-Check-Time-of-Use (TOCTOU) race condition with path confusion to achieve SYSTEM-level access on Windows systems.
The exploit operates through six coordinated stages. First, it retrieves a legitimate Windows Defender signature update from Microsoft's official URL (go.microsoft.com). Second, it drops a reversed EICAR test file and monitors Volume Shadow Copy snapshots via NtQueryDirectoryObject. Third, it registers a Cloud Files sync root with a callback that identifies the Windows Defender process by PID using the CfRegisterSyncRoot and CfConnectSyncRoot APIs. Fourth, it takes a batch oplock on the mpasbase.vdm file and swaps directory junctions to \BaseNamedObjects\Restricted using NtCreateSymbolicLinkObject. Fifth, it triggers the update process by invoking Proc42_ServerMpUpdateEngineSignature via the Windows Defender RPC interface. Finally, it exploits the resulting race condition to access the Security Account Manager (SAM) database, extracts password hashes using offline registry parsing (OROpenHive), modifies the user password, creates a temporary SYSTEM service for privilege escalation, and then restores the original NT hashes to avoid detection.
SAM hash decryption supports both AES (Revision 3) and RC4 (Revision 2) for SAM key decryption, with AES or RC4 plus DES-ECB for NT hash decryption. The boot key is extracted from the live SYSTEM registry class names with permutation.
The exploit codebase is structured across multiple modules: update.cpp (PE resource parsing, cabinet extraction via FDI), vss.cpp (EICAR drops, VSS monitoring), cloudfiles.cpp (Cloud Files sync root registration with batch oplock), race.cpp (junction swapping, symbolic link creation), sam.cpp (offline SAM parsing via OROpenHive), escalate.cpp (Net API password changes, service creation), and main.cpp (stage orchestration). The PoC dynamically loads cldapi.dll, offreg.dll, and samlib.dll at runtime.
The exploit has been confirmed functional on Windows 11 25H2 by security researcher Will Dormann, principal vulnerability analyst at Tharros. Testing indicates it is non-functional on Windows 11 22H2, 23H2, and 24H2. On Windows Server platforms, the exploit is limited to escalating from non-admin to elevated administrator rather than full SYSTEM access. The PoC contains intentional bugs that reduce reliability but is acknowledged as operationally useful.
The researcher, operating under the aliases Chaotic Eclipse and Nightmare-Eclipse, published the exploit on GitHub on April 3, 2026 after frustrations with Microsoft's Security Response Center (MSRC) handling of the vulnerability disclosure. MSRC reportedly required a video demonstration of the exploit as part of the submission process, which the researcher viewed as an unreasonable friction point. The researcher stated: 'I was not bluffing Microsoft, and I'm doing it again' and 'I'm not explaining how this works; y'all geniuses can figure it out.'
The exploit exhibits notable operational security characteristics: it makes only a single network connection to a legitimate Microsoft URL, deletes the temporary SYSTEM service after exploitation, and restores original NT hashes to minimize forensic evidence. These anti-forensic features increase the risk if adopted by ransomware groups or advanced threat actors for post-compromise privilege escalation.
MITRE ATT&CK techniques used in TL-2026-0329
credential-access
T1003 OS Credential Dumping; T1556 Modify Authentication Process
defense-evasion
T1036 Masquerading; T1070 Indicator Removal
privilege-escalation
T1068 Exploitation for Privilege Escalation
discovery
T1082 System Information Discovery
execution
T1106 Native API; T1569 System Services
persistence
T1543 Create or Modify System Process; T1574 Hijack Execution Flow
defense-impairment
Affected products and versions in BlueHammer Windows Zero-Day Local Privilege Escalation to
- Microsoft — Windows 11
Vulnerable versions: 25H2 - Microsoft — Windows 11
Vulnerable versions: 22H2; 23H2; 24H2 - Microsoft — Windows Server
Vulnerable versions: 2019; 2022; 2025 - Microsoft — Windows Defender
Vulnerable versions: All current versions with signature update mechanism
Remediation for BlueHammer Windows Zero-Day Local Privilege Escalation to
Patches
- No patch available as of 2026-04-07 — vulnerability is an active zero-day
- Monitor Microsoft Security Response Center for future advisory and patch release
Immediate actions
- Restrict local system access to trusted users only
- Monitor for suspicious Cloud Files API usage (CfRegisterSyncRoot) by non-standard processes
- Monitor for batch oplock creation on mpasbase.vdm
- Alert on unexpected NTFS junction creation in \BaseNamedObjects\Restricted
- Monitor for offline SAM registry access via offreg.dll loading
- Deploy endpoint detection rules for BlueHammer exploit chain indicators
Workarounds
- Restrict execution of unsigned PE binaries on endpoints
- Monitor and alert on Windows Defender RPC interface calls from non-Defender processes
- Enable Controlled Folder Access to detect suspicious file operations
- Consider implementing application whitelisting on critical systems
Longer-term hardening
- Deploy EDR with behavioral detection for TOCTOU-based privilege escalation chains
- Implement Windows Defender Application Control (WDAC) to restrict unsigned binary execution
- Enable Windows Credential Guard to protect credential material
- Implement network segmentation to limit lateral movement from compromised hosts
- Monitor for anomalous service creation and deletion patterns
- Audit and restrict access to offline registry libraries (offreg.dll)
Weaknesses (CWE) in BlueHammer Windows Zero-Day Local Privilege Escalation to
CWE-367, CWE-427
Timeline of BlueHammer Windows Zero-Day Local Privilege Escalation to
- Researcher Chaotic Eclipse (Nightmare-Eclipse) reports vulnerability to Microsoft Security Response Center (MSRC) through coordinated disclosure
- MSRC requires video demonstration of exploit as part of submission process, creating friction with researcher who views this as an unreasonable barrier
- MSRC case stalled or closed without resolution; researcher expresses frustration with handling of disclosure
- Nightmare-Eclipse publishes BlueHammer PoC on GitHub with intentional bugs, stating 'I was not bluffing Microsoft, and I'm doing it again'
- Security researcher 0xjustBen publishes reattempt repository with detailed technical analysis of the six-stage exploit chain
- BleepingComputer, Security Affairs, CybersecurityNews, SecurityOnline, and TechNadu publish coverage of BlueHammer zero-day
- Will Dormann, principal vulnerability analyst at Tharros, independently confirms exploit works: 'Maybe not 100% reliably, but well enough'
- SOCRadar, GBHackers, CyberPress, and News9Live publish additional coverage; ransomware groups identified as potential adopters
- Microsoft provides statement acknowledging awareness of BlueHammer but no patch released; vulnerability remains active zero-day
- As of 2026-05-29, BlueHammer was assigned CVE-2026-33825 and patched by Microsoft on April 14, 2026, but it remains a live concern: CISA added it to KEV on April 22 (deadline May 7) and it is actively exploited in the wild. Multiple ransomware groups have weaponized it alongside sibling exploits RedSun/UnDefend, so unpatched Windows systems stay at real risk.
Sources cited for BlueHammer Windows Zero-Day Local Privilege Escalation to
- BleepingComputer: Disgruntled researcher leaks BlueHammer Windows zero-day exploit
- SOCRadar: BlueHammer Windows Zero-Day Privilege Escalation Risk
- Security Affairs: Experts published unpatched Windows zero-day BlueHammer
- SecurityOnline: BlueHammer Windows Defender 0-Day LPE Exploit
- CybersecurityNews: Researcher Released Windows Defender 0-Day Exploit Code
- GitHub PoC: Nightmare-Eclipse/BlueHammer
- GitHub: 0xjustBen/BlueHammer — Reattempt with detailed technical analysis
- TechNadu: BlueHammer Windows Zero-Day Exploit Leaks Online
- GBHackers: Windows Defender 0-Day Published Online
- CyberPress: Researcher Releases Windows Defender 0-Day Exploit Granting Full System Access
- News9Live: BlueHammer — Researcher drops Windows zero-day exploit
Threats related to BlueHammer Windows Zero-Day Local Privilege Escalation to
Detection coverage for TL-2026-0329
As of 2026-04-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0329 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.