CVE-2026-33825: Microsoft Defender Local Privilege Escalation via BlueHammer TOCTOU Race Condition
CVE-2026-33825 (TL-2026-0367), also tracked as BlueHammer, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-04-15 and last reviewed 2026-07-11. It has no confirmed attribution, affects Microsoft Microsoft Defender Antivirus, references 1 CVE (CVE-2026-33825), maps to 23 MITRE ATT&CK techniques (T1003, T1005, T1016), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-0367
- Threat ID
- TL-2026-0367
- Also known as
- BlueHammer, Blue Hammer, SNEK Blue War Hammer
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-04-15
- Last reviewed
- 2026-07-11
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government, financial, healthcare, technology, education, critical-infrastructure, defense, energy
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
- Updates
- 2026-07-11 · revalidated 1× · latest source
Malware and tooling in CVE-2026-33825
Malware and tooling: Exploit:Win32/DfndrPEBluHmr.BB, RedSun, UnDefend, BlueHammer
A local privilege escalation vulnerability in Microsoft Defender's signature-update mechanism combines a TOCTOU race condition with path confusion to allow low-privileged users to access the SAM database, dump NTLM hashes, and escalate to NT AUTHORITY\SYSTEM. A fully functional public PoC (BlueHammer) was leaked on GitHub on April 3, 2026 by researcher 'Chaotic Eclipse' after MSRC disclosure frustration. Patched in April 2026 Patch Tuesday (Antimalware Platform 4.18.26050.3011).
How CVE-2026-33825 works
CVE-2026-33825 is a local privilege escalation vulnerability in Microsoft Defender Antivirus's signature update mechanism that allows a low-privileged local user to escalate to NT AUTHORITY\SYSTEM. The vulnerability, publicly known as 'BlueHammer,' was discovered by security researcher 'Chaotic Eclipse' (GitHub alias: Nightmare-Eclipse) and leaked as a fully functional proof-of-concept on GitHub on April 3, 2026, after frustration with Microsoft Security Response Center's (MSRC) disclosure handling process.
The exploit chains together five legitimate Windows features in a novel TOCTOU (Time-of-Check to Time-of-Use) race condition combined with path confusion. The attack begins by querying Windows Update COM interfaces for pending Defender signature updates and downloading the legitimate update executable to extract the embedded CAB file containing mpasbase.vdm. The attacker then drops an EICAR test file to bait Defender into scanning activity, places a batch opportunistic lock (oplock) on RstrtMgr.dll as a timing tripwire, and enumerates \\Device for HarddiskVolumeShadowCopy devices.
The critical freezing phase leverages Windows Cloud Files API abuse. The exploit registers a directory as a Cloud Files sync root via CfRegisterSyncRoot() (using the provocative provider name 'IHATEMICROSOFT'), places a .lock placeholder file, and when Defender accesses this file, the batch oplock freezes the Defender process at a precise timing window via GetOverlappedResult blocking. With Defender frozen, the exploit accesses the SAM, SYSTEM, and SECURITY registry hives through VSS shadow copy device paths (\\Device\HarddiskVolumeShadowCopy*\Windows\System32\Config\{SAM,SYSTEM,SECURITY}).
The credential extraction phase recovers the Windows boot key from the SYSTEM hive's Control\Lsa registry keys (JD, Skew1, GBG, Data), then uses this to decrypt the LSA secret key and Password Encryption Key, ultimately decrypting NTLM hashes via AES/DES operations in a Mimikatz-style routine. The final escalation phase changes the local Administrator password (using the hardcoded temporary password '$PWNed666!!!WDFAIL') via SamiChangePasswordUser(), authenticates via LogonUserEx(), duplicates the token with SYSTEM integrity, creates a temporary GUID-named Windows service spawning cmd.exe as NT AUTHORITY\SYSTEM, and then restores the original password hash to cover tracks.
Microsoft patched the vulnerability in the April 8, 2026 Patch Tuesday release with Antimalware Platform version 4.18.26050.3011. Microsoft credited Zen Dodd and Yuanpei XU of HUST with Diffract for the advisory. Will Dormann of Tharros confirmed the PoC no longer works after the patch. However, the exploit code was publicly available for 5 days before the patch, and a reimplementation by 'atroubledsnake' (SNEK_BlueWarHammer) with bug fixes and Visual Studio 2022 build instructions further lowers the barrier to exploitation. Microsoft Defender's static signature (Exploit:Win32/DfndrPEBluHmr.BB) only detects the original PoC binary, and a basic recompile defeats it, making behavioral detection essential.
The exploit requires local access, an active Windows Defender installation, and a pending Defender definition update. It is most reliable on Windows 10 and Windows 11 desktop systems; exploitation on Windows Server editions is unreliable and only elevates to administrator level rather than SYSTEM. The exploit's dependency on Defender update timing introduces unreliability, and the original PoC contained several implementation bugs including uninitialized handle pointers, incorrect buffer sizing in cryptographic operations, and race condition timing issues — all of which were fixed in the SNEK reimplementation.
Related historical vulnerabilities include CVE-2021-36934 (HiveNightmare) which also exposed SAM hive data through permissive ACLs, and multiple Cloud Files driver elevation-of-privilege vulnerabilities (CVE-2025-55680, CVE-2025-62221, CVE-2024-30085, CVE-2024-49114, CVE-2025-21271) indicating a persistent pattern of security issues in the Windows Cloud Files subsystem.
MITRE ATT&CK techniques used in TL-2026-0367
Credential Access
T1003 OS Credential Dumping; T1552 Unsecured Credentials
Collection
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1087 Account Discovery
Execution
T1059 Command and Scripting Interpreter; T1569 System Services
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism
Defense Evasion
T1070 Indicator Removal; T1211 Exploitation for Stealth; T1574 Hijack Execution Flow
Persistence
T1098 Account Manipulation; T1543 Create or Modify System Process
Command and Control
Initial Access
T1133 External Remote Services
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop
Lateral Movement
T1550 Use Alternate Authentication Material
defense-impairment
Affected products and versions in CVE-2026-33825
- Microsoft — Microsoft Defender Antivirus
Vulnerable versions: Antimalware Platform < 4.18.26050.3011
Fixed in: Antimalware Platform 4.18.26050.3011 - Microsoft — Windows 10
Vulnerable versions: All versions with Defender < 4.18.26050.3011
Fixed in: With Antimalware Platform 4.18.26050.3011 - Microsoft — Windows 11
Vulnerable versions: All versions with Defender < 4.18.26050.3011
Fixed in: With Antimalware Platform 4.18.26050.3011 - Microsoft — Windows Server
Vulnerable versions: 2019, 2022 with Defender (unreliable exploitation)
Fixed in: With Antimalware Platform 4.18.26050.3011
Remediation for CVE-2026-33825
Patches
- Microsoft Antimalware Platform 4.18.26050.3011 (April 8, 2026 Patch Tuesday)
- Windows Security > Virus & threat protection > Protection Updates > Check for updates
Immediate actions
- Apply Antimalware Platform update 4.18.26050.3011 immediately via Windows Update or Microsoft Update Catalog (KB4052623)
- Verify Windows Defender Tamper Protection is enabled on all endpoints
- Force Defender signature updates on frequent cadence (every 4-8 hours)
- Monitor for Event IDs 4723/4724 (password change/reset) on local administrator accounts
- Block unsigned and user-space executables from running in %TEMP% and Downloads via WDAC or AppLocker in enforcement mode
Workarounds
- Disable non-essential local administrator accounts where possible
- Restrict Cloud Files sync root registration to approved cloud provider applications only
- Implement application control policies to block execution from user-writable directories
- Enable Windows Credential Guard to protect cached credentials
Longer-term hardening
- Deploy kernel-level EDR with behavioral detection for Cloud Files API abuse, oplock manipulation, and VSS enumeration from user-space processes
- Implement SIEM correlation rules for rapid password change-logon-restore cycles
- Deploy BlueHammerFix Sigma rules (7 rules) and YARA rules (4 rules) from technoherder/BlueHammerFix GitHub repository
- Restrict local administrator account usage and implement LAPS (Local Administrator Password Solution)
- Monitor for non-LSASS processes loading samlib.dll and GUID-named temporary service creation
CVEs associated with CVE-2026-33825
Weaknesses (CWE) in CVE-2026-33825
CWE-367, CWE-22, CWE-1220
Timeline of CVE-2026-33825
- Chaotic Eclipse privately discloses vulnerability to Microsoft Security Response Center (MSRC)
- Chaotic Eclipse (Nightmare-Eclipse) publicly leaks BlueHammer PoC on GitHub after frustration with MSRC disclosure process
- SNEK_Blue-War-Hammer reimplementation published by atroubledsnake with bug fixes, Visual Studio 2022 build instructions, and precompiled binary (SNEK_BlueWarHammer.exe v1.0.0)
- BleepingComputer publishes first major news coverage of the BlueHammer leak; Will Dormann (Tharros) confirms functional exploitation
- Cyderes Howler Cell publishes detailed technical analysis; RH-ISAC issues advisory; BlueHammerFix repository released with 7 Sigma rules, 4 YARA rules, and MITRE-mapped report
- Microsoft Defender adds static signature Exploit:Win32/DfndrPEBluHmr.BB detecting original PoC binary (bypassed by recompilation)
- Will Dormann (Tharros) confirms BlueHammer PoC no longer works after applying Antimalware Platform update 4.18.26050.3011
- Microsoft April 2026 Patch Tuesday assigns CVE-2026-33825 and releases Antimalware Platform 4.18.26050.3011 fix; credits Zen Dodd and Yuanpei XU of HUST with Diffract
- Huntress Labs observes BlueHammer weaponized in the wild ahead of the patch, including a hands-on-keyboard engagement via SSL VPN access to a FortiGate firewall with recon commands (whoami /priv, cmdkey /list, net group).
- PoCs for two related, still-unpatched Defender zero-days from the same researcher — RedSun (LPE via cloud-file rollback abuse) and UnDefend (DoS blocking definition updates) — observed weaponized.
- The Hacker News publishes analysis of all three Defender zero-days (BlueHammer, RedSun, UnDefend) describing a layered-degradation attack strategy.
- CISA adds CVE-2026-33825 to the Known Exploited Vulnerabilities catalog with ransomware campaign use flagged; FCEB remediation due 2026-05-06 under BOD 22-01.
- As of 2026-05-29, CVE-2026-33825 (BlueHammer) is patched (Defender Antimalware Platform 4.18.26050.3011) and the fix is confirmed effective, but it was added to CISA KEV after Huntress observed hands-on-keyboard in-the-wild exploitation (with RedSun/UnDefend, Russia-linked FortiGate access). Public, recompilable exploit tooling keeps unpatched endpoints at live risk.
- CISA confirms to BleepingComputer that ransomware operators are actively exploiting BlueHammer in live campaigns; specific ransomware group and additional IOC detail withheld.
- CISA states CVE-2026-33825 exploitation has moved from PoC noise to real ransomware attacks in the wild; KEV catalog entry updated to document ransomware usage.
Update history for TL-2026-0367
- 2026-07-11 — CVE-2026-33825 "BlueHammer" — Microsoft Defender Privilege Escalation Now Exploited by Ransomware Gangs: What changed Exploitability POC_PUBLIC → ACTIVE and status MONITORING → ACTIVE, driven by CISA's 2026-06-30 confirmation of active ransomware exploitation (KEV entry updated 2026-07-01); attribution_confidence NONE → LOW and motivation UNKN
Sources cited for CVE-2026-33825
- BleepingComputer: Disgruntled researcher leaks BlueHammer Windows zero-day exploit
- Cyderes Howler Cell: BlueHammer Inside the Windows Zero-Day
- RH-ISAC: BlueHammer Windows LPE Zero-Day Publicly Released
- Microsoft April 2026 Patch Tuesday (163 Flaws, Two Zero-Days)
- Help Net Security: BlueHammer Windows zero-day exploit leaked
- SOCRadar: BlueHammer Windows Zero-Day Privilege Escalation Risk
- CSO Online: April Patch Tuesday roundup — zero-day vulnerabilities and critical bugs
- Penligent: BlueHammer and the Windows Defender Race to SYSTEM
- Exploit Pack: BlueHammer Analysis (Defender LPE)
- CyberSecurityNews: BlueHammer PoC for Windows Defender Exploited by Researchers
- Automox: BlueHammer What You Need to Know and How to Respond
- GitHub: BlueHammerFix — 7 Sigma rules, 4 YARA rules, MITRE ATT&CK-mapped report
- GitHub: Nightmare-Eclipse/BlueHammer — Original PoC repository
- GitHub: atroubledsnake/SNEK_Blue-War-Hammer — Reimplementation with bug fixes
- Tenable: Microsoft April 2026 Patch Tuesday Addresses 163 CVEs
Threats related to CVE-2026-33825
- NightmareEclipse Coordinated Disclosure Breach Campaign: 9+ Windows Zero-Days (CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-45585, CVE-2026-45586) Dumped Outside Responsible Disclosure and Weaponized in Real-World Intrusions
- RoguePlanet: Microsoft Defender Elevation of Privilege Vulnerability (CVE-2026-50656) Patched
- Windows Defender Zero-Days (BlueHammer/RedSun/UnDefend) — Leaked Nightmare-Eclipse Exploits Weaponized In-The-Wild for SYSTEM LPE (CVE-2026-33825)
- BlueHammer Windows Zero-Day Local Privilege Escalation to SYSTEM via TOCTOU Race Condition and Path Confusion
- Windows Defender 0-Day Local Privilege Escalation "RoguePlanet" (Nightmare Eclipse Defender Exploit Series)
- Microsoft April 2026 Patch Tuesday — 163 CVEs / 88 Advisories (CVE-2026-32201 SharePoint Zero-Day Exploited In-The-Wild, CVE-2026-33825 Defender EoP Public PoC, CVE-2026-33824 IKE RCE CVSS 9.8, CVE-2026-33827 TCP/IP Wormable RCE)
Detection coverage for TL-2026-0367
As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0367 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.