Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-33825 7.8
Microsoft · Defender · Added 2026-04-22 · Published 2026-04-14
3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityMicrosoft Defender Insufficient Granularity of Access Control Vulnerability
VendorMicrosoft
ProductDefender
Date added2026-04-22
Due date2026-05-06
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-1220
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.

NVD: Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Compliance SSVC + BOD 26-04

Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required

Research metadata

Last researched2026-08-27 10:42 UTC
Wall time45.0s
Searches6
Component defaultyes
Sources https://github.com/0xBlackash/CVE-2026-33825
https://github.com/Nightmare-Eclipse/BlueHammer
https://github.com/chenTest2019/BlueHammer
https://github.com/kaleth4/CVE-2026-33825
https://keepsecure-labs/hub/blob/main/cve-2026-33825-windows-defender-bluehammer.md
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825
https://nvd.nist.gov/vuln/detail/CVE-2026-33825
https://www.huntress.com/blog/nightmare-eclipse-intrusion
https://www.picussecurity.com/resource/blog/bluehammer-redsun-windows-defender-cve-2026-33825-zero-day-vulnerability-explained

QC notes

warn component_extraction: Component 'Microsoft Defender Antimalware Platform (MsMpEng.exe) — threat remediation engine and signature update mechanism' matches or contains product name 'Defender' — no specific component identified

Hunting hypothesis agent

Hunt Sysmon reparse events for batch oplocks freezing MsMpEng.exe I/O on Defender staging files, then NTFS junctions to System32 for SYSTEM binary overwrite or HarddiskVolumeShadowCopy for SAM hive extraction.

Research details

ComponentMicrosoft Defender Antimalware Platform (MsMpEng.exe) — threat remediation engine and signature update mechanism
PreconditionsLocal low-privileged user account on target Windows system; Target must run a vulnerable Microsoft Defender Antimalware Platform version (< 4.18.26030.3011); NTFS filesystem with support for opportunistic locks (oplocks) and reparse points/junction points; Attacker must be able to write files that trigger Defender real-time detection (e.g., EICAR test file) agent
DeliveryLocal execution via existing initial access (e.g., standard user account, phishing foothold, or compromised credentials). No additional user interaction required post-access. The exploit chain: (1) place file triggering Defender detection, (2) use NTFS batch oplock to pause Defender's remediation, (3) create NTFS junction point redirecting to C:\Windows\System32, (4) release oplock — Defender (running as SYSTEM) follows junction and writes attacker payload to System32, (5) DLL hijack or execution of overwritten system binary escalates to SYSTEM.
Public PoCyes
PoC URLs https://github.com/0xBlackash/CVE-2026-33825
https://github.com/chenTest2019/BlueHammer
https://github.com/kaleth4/CVE-2026-33825 Third-party repos; verify before use.
Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825
Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.8) | TOCTOU race condition requiring precise timing via NTFS batch opportunistic locks (oplocks) | Multiple public PoCs available under nickname 'BlueHammer' | Active exploitation observed by Huntress Labs starting April 10, 2026 (4 days before patch) | Exploitation chain takes <2 seconds from trigger to SYSTEM access | Patched in Microsoft Defender Antimalware Platform version 4.18.26030.3011 (KB4052623) released April 14, 2026 Patch Tuesday | Zero-day disclosure on April 2, 2026 by researcher 'Nightmare-Eclipse'/'Chaotic Eclipse' in protest of MSRC disclosure handling | Original Nightmare-Eclipse/BlueHammer repo removed; mirrors at 0xBlackash and chenTest2019 forks
SummaryMicrosoft Defender (MsMpEng.exe) TOCTOU race condition in threat remediation engine (CWE-1220) | Public PoC 'BlueHammer' released April 2, 2026 by Nightmare-Eclipse before patch available | Active exploitation confirmed by Huntress Labs from April 10, 2026 — attackers accessed via FortiGate SSL VPN from Russia-geolocated IP | CISA KEV added April 22, 2026 | Patch released April 14, 2026 Patch Tuesday — platform version 4.18.26030.3011 | Exploit abuses NTFS batch oplocks to freeze Defender I/O, replaces staging directory with NTFS junction pointing to C:\Windows\System32, then Defender (running as SYSTEM) writes attacker payload to targeted system binary | Also used for SAM hive extraction via Volume Shadow Copy + object manager symlink chain, enabling NTLM hash theft and password changes | Part of 3-exploit trilogy (BlueHammer LPE, RedSun LPE via cloud rollback, UnDefend for protection degradation), only CVE-2026-33825 has a patch

Tia coverage

First reported2026-06-10
First exploit report2026-05-20
Exploit report → KEV28 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

rogueplanet-microsoft-defender-race-condition-zero-day-grants-sy

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub