Executive brief
A vulnerability in Microsoft Defender, the built-in security software for Windows, allows an attacker who already has limited access to a computer to gain full administrative control. By exploiting a flaw in how the software manages file access during system scans and updates, an attacker can bypass security restrictions to read sensitive system files, such as password databases. This could lead to a complete takeover of the affected machine and allow the attacker to move deeper into a corporate network.
Technical details
A local privilege escalation vulnerability exists in the Microsoft Defender Antimalware Platform due to a Time-of-Check to Time-of-Use (TOCTOU) race condition (CWE-367) and insufficient access control granularity (CWE-1220). The flaw, publicly known as 'BlueHammer', involves abusing the Volume Shadow Copy Service (VSS) snapshots created by Defender during malware remediation or update processes. An attacker can use opportunistic locks (oplocks) to 'pause' Defender's operations while a snapshot is exposed, allowing them to race the process and obtain an arbitrary read handle to sensitive files like the Security Account Manager (SAM) database. This enables an unprivileged local user to escalate to SYSTEM privileges. Microsoft has released a patch in version 4.18.26030.3011 to address this issue, which has been observed in active exploitation.
Affected products
- Microsoft Defender Antimalware Platform 4.0.0.0 up to (excluding) 4.18.26030.3011
Timeline
- 2026-04-02: disclosed: Public release of 'BlueHammer' exploit by researcher Nightmare-Eclipse
- 2026-04-14: patched: Microsoft released security updates and assigned CVE-2026-33825
- 2026-04-20: exploited: Huntress reported in-the-wild exploitation in real-world intrusions
- 2026-04-22: kev added: CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog