Latest Microsoft Defender Flaw Exploited by Hackers as Zero-Day Vulnerability

Post Views: 9

Microsoft Privilege Escalation Vulnerability Exploited as Zero-Day

A recently discovered vulnerability in Microsoft’s Defender software has been exploited as a zero-day attack, allowing attackers to gain System privileges. On April 14, Microsoft released a patch for the flaw, identified as CVE-2026-33825, but not before it was publicly disclosed on April 2 by a researcher known as Chaotic Eclipse.

Exploit Techniques

BlueHammer: A time-of-check to time-of-use (TOCTOU) vulnerability in the signature update mechanism, allowing attackers to suspend Defender’s operation and trick it into copying the Security Account Manager (SAM) database to its output directory.
RedSun: Rewriting critical system files to achieve System privileges.
UnDefend: Killing Defender by locking definition files.

According to Huntress, the first attacks leveraging the publicly available proof-of-concept (PoC) exploit code were detected on April 10, with additional activity observed on April 16.

The attackers accessed the target environment through an SSL VPN connection to a FortiGate firewall and staged binaries from a low-privilege user’s Pictures folder. However, they were unsuccessful in exploiting the vulnerability due to their lack of familiarity with how the Defender exploits worked.

Action Taken

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-33825 to its Known Exploited Vulnerabilities (KEV) catalog on April 26, urging federal agencies to patch the vulnerability by May 6.

Microsoft released a patch for the vulnerability on April 14, addressing the issue and preventing further exploitation.