CVE-2026-33825: Microsoft Defender privilege escalation in Antimalware Platform

CVE-2026-33825 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2026-04-14

A vulnerability in Microsoft Defender, the built-in security software for Windows, allows an attacker who already has limited access to a computer to gain full administrative control. By exploiting a flaw in how the software manages file access during system scans and updates, an attacker can bypass security restrictions to read sensitive system files, such as password databases. This could lead to a complete takeover of the affected machine and allow the attacker to move deeper into a corporate network.

Technologies: Microsoft Defender. Vendors: Microsoft.

Quick answers

Is CVE-2026-33825 exploited in the wild?
Yes. CVE-2026-33825 is known to be exploited in the wild, first recorded on 22 April 2026. Treat it as urgent.
How severe is CVE-2026-33825?
Critical severity, with a CVSS score of 7.8, published 14 April 2026.
Which products and versions are affected?
Microsoft Defender Antimalware Platform 4.0.0.0 up to (excluding) 4.18.26030.3011, versions up to (excluding) 4.18.26030.3011.
Is there a fix for CVE-2026-33825?
A patch was published on 2026-04-14: Microsoft released security updates and assigned CVE-2026-33825 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33825 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-33825?
Check whether you run Microsoft Defender or Microsoft Defender Antimalware Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A local privilege escalation vulnerability exists in the Microsoft Defender Antimalware Platform due to a Time-of-Check to Time-of-Use (TOCTOU) race condition (CWE-367) and insufficient access control granularity (CWE-1220). The flaw, publicly known as 'BlueHammer', involves abusing the Volume Shadow Copy Service (VSS) snapshots created by Defender during malware remediation or update processes. An attacker can use opportunistic locks (oplocks) to 'pause' Defender's operations while a snapshot is exposed, allowing them to race the process and obtain an arbitrary read handle to sensitive files like the Security Account Manager (SAM) database. This enables an unprivileged local user to escalate to SYSTEM privileges. Microsoft has released a patch in version 4.18.26030.3011 to address this issue, which has been observed in active exploitation.

Affected products

  • Microsoft Defender Antimalware Platform 4.0.0.0 up to (excluding) 4.18.26030.3011

Timeline

  • 2026-04-02: disclosed: Public release of 'BlueHammer' exploit by researcher Nightmare-Eclipse
  • 2026-04-14: patched: Microsoft released security updates and assigned CVE-2026-33825
  • 2026-04-20: exploited: Huntress reported in-the-wild exploitation in real-world intrusions
  • 2026-04-22: kev added: CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.