CISA orders feds to patch BlueHammer flaw exploited as zero-day

CISA has given U.S. government agencies two weeks to secure their Windows systems against a Microsoft Defender privilege escalation vulnerability that has been exploited in zero-day attacks. Tracked as CVE-2026-33825, this high-severity security flaw allows low-privileged local threat actors to gain SYSTEM permissions on unpatched devices by exploiting an insufficient granularity of access control weakness. Microsoft patched the vulnerability on April 14 as part of this month's Patch Tuesday, one week after a security researcher using the "Chaotic Eclipse" handle dubbed it "BlueHammer" and published proof-of-concept exploit code in protest to how Microsoft's Security Response Center (MSRC) handled the disclosure process. Chaotic Eclipse also disclosed a second Microsoft Defender privilege escalation flaw (dubbed RedSun) and a third flaw (known as UnDefend) that can be exploited as a standard user to block Defender definition updates. At the time of the leak, all three vulnerabilities were considered zero-days by Microsoft's definition, since they had no official patches. Additionally, as Huntress Labs security researchers revealed on April 16, attackers had also been exploiting these zero-days in attacks that showed evidence of "hands-on-keyboard threat actor activity." "The activity also appeared to be part of a broader intrusion rather than isolated proof-of-concept (PoC) testing," the cybersecurity company said in a Monday report. "Huntress identified suspicious FortiGate...