Picus Security: BlueHammer & RedSun

On April 7, 2026, a zero-day vulnerability in Microsoft Defender, tracked as CVE-2026-33825 , was publicly disclosed alongside a working proof-of-concept exploit. The vulnerability enables local privilege escalation, allowing an unprivileged user to gain SYSTEM-level access on fully patched Windows 10 and Windows 11 systems. The exploit, referred to as " BlueHammer ", was released prior to the availability of an official fix, making it a true zero-day at the time of disclosure.

In this blog, we explain how the Windows Defender CVE-2026-33825 vulnerability works, its real-world risk to organizations, and provide practical steps for validation and remediation.

Simulate Vulnerability Exploitation Attacks with 14-Day Free Trial of Picus Platform

Windows Defender is the built-in antimalware solution included with every installation of Windows 10 and Windows 11. It provides real-time protection against viruses, malware, spyware, and other threats by continuously scanning files, monitoring system behavior, and leveraging cloud-delivered protection for rapid threat detection. As the default security product on over a billion Windows devices worldwide, Defender represents a critical layer of defense for consumers, enterprises, and government organizations alike.

On April 7, 2026, a zero-day vulnerability in Microsoft Defender was publicly disclosed alongside a fully functional proof-of-concept exploit known as " BlueHammer ". On the following Patch Tuesday, Microsoft released a security update addressing the issue, tracked as CVE-2026-33825 [1]. The vulnerability was assigned a CVSS score of 7.8 (High) . It stems from a race condition in Windows Defender's file remediation logic, which can be exploited to overwrite arbitrary files on the system. Successful exploitation enables attackers to achieve SYSTEM-level code execution from an unprivileged account.

CVE-2026-33825 is part of a broader pattern rather than an isolated flaw. Within a 13-day window in April 2026, multiple zero-day exploits targeting Windows Defender were disclosed. " BlueHammer " enables local privilege escalation through Defender's file remediation logic. Shortly after, " UnDefend " was released, which disrupts Defender's update mechanism and gradually weakens its protection. This was followed by " RedSun ", another privilege escalation technique that abuses Defender's handling of cloud-tagged files to overwrite system paths. Together, these exploits highlight systemic weaknesses in Defender's architecture. One enables privilege escalation, another degrades protection over time, and a third introduces an alternative escalation path even after patching. The sequence shows how attackers can chain vulnerabilities to bypass defenses and maintain access.

The affected products and remediation guidance are listed below. Organizations are strongly advised to apply the April 2026 Patch Tuesday security updates immediately.

Windows 10 (all supported versions)

Windows 11 (all supported versions)

Windows Server 2016, 2019, 2022, 2025

Microsoft Defender Antivirus (pre-April 2026 update)

CVE-2026-33825 is a local privilege escalation vulnerability rooted in a time-of-check to time-of-use (TOCTOU) race condition within Windows Defender's threat remediation engine. The vulnerability exists because Defender performs privileged file operations during malware cleanup without adequately validating the file path at the time of the write operation, allowing an attacker to redirect the operation using filesystem manipulation techniques.

The BlueHammer exploit works by first placing a file that triggers a Defender detection. When Defender's real-time protection engine detects this file and initiates remediation, the exploit uses a batch opportunistic lock (oplock) to pause Defender's file operation at a critical point. During this pause, the exploit modifies the filesystem by creating an NTFS junction point (a type of directory symbolic link) that redirects Defender's target path from the attacker-controlled temporary directory to C:\Windows\System32 .

When the oplock is released, and Defender resumes its file operation, it follows the junction and writes to the redirected location under its SYSTEM-level privileges. The attacker can use this to overwrite a legitimate system executable with a malicious payload. Once the overwritten service binary is executed by the system, the attacker achieves SYSTEM-level code execution.

RedSun is a local privilege escalation technique that abuses Windows Defender’s cloud file rollback mechanism. When Defender detects a cloud-tagged file, it attempts to restore it to its original location without validating the target path. This creates an opportunity for attackers to redirect the write operation to a privileged directory.

The exploit works by first triggering a Defender detection using a crafted file, then replacing it with a cloud placeholder via the Windows Cloud Files API . As Defender initiates its rollback process, the attacker uses filesystem manipulation techniques, including NTFS junctions and opportunistic locks , to pause execution and redirect the target path to C:\Windows\System32 .

When Defender resumes the rollback operation, it follows the redirected path and writes the file with SYSTEM-level privileges. This allows the attacker to overwrite a system binary and achieve SYSTEM-level code execution without requiring elevated privileges or user interaction.

We also strongly suggest simulating the Windows Defender CVE-2026-33825 vulnerability to test the effectiveness of your security controls against sophisticated cyber attacks using the Picus Security Validation Platform . You can also test your defenses against oth er vulnerability exploitation attacks, such as regreSSHion, Citrix Bleed, and Follina , within minutes with a 14-day free trial of the Picus Platform .

Picus Threat Library includes the following threats for Windows Defender CVE-2026-33825 exploitation attacks :

Windows Defender BlueHammer Elevation of Privilege Vulnerability Threat

Windows Defender BlueHammer Elevation of Privilege Vulnerability Threat

Email Infiltration (Phishing)

Windows Defender RedSun Elevation of Privilege Vulnerability Threat

Windows Defender RedSun Elevation of Privilege Vulnerability Threat

Email Infiltration (Phishing)

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Security Validation Platform.

[1] "Security Update Guide - Microsoft Security Response Center." Available: