Ransomware gangs are exploiting a Windows Defender flaw called BlueHammer
CISA has confirmed that ransomware operators are actively exploiting CVE-2026-33825, a privilege-escalation vulnerability in Microsoft Defender that's been given the nickname BlueHammer. Microsoft patched it on 14 April and CISA added it to its Known Exploited Vulnerabilities catalogue on 22 April; the ransomware confirmation is the new part. The flaw doesn't get an attacker into a machine on its own, it's used after initial access to jump from a limited foothold to full administrative control, which is precisely the step that turns a contained incident into a full-blown ransomware deployment.
This is what makes privilege-escalation bugs in security software particularly frustrating: Defender is meant to be the thing stopping the attack, not a stepping stone through it. It's a reminder that every piece of software running with elevated privileges, security tools included, is itself part of the attack surface.
What BlueHammer actually does
Think of a ransomware attack as a chain. Someone phishes a user, buys stolen credentials or hits an exposed service. That gets them a limited account on one machine. From there, they need much more power before they can do real damage.
A standard user cannot switch off backups, disable security tooling or push software across a network. An administrator can. Privilege escalation is the bridge between the two, and BlueHammer is one of those bridges.
Security software makes an attractive target for a simple reason. Antivirus engines run with very high privileges, because they have to inspect almost everything on the system. A bug in one hands an attacker that same power.
Why the confirmation from CISA matters
CISA does not describe a flaw as actively exploited by ransomware operators lightly. It tells defenders that this is no longer a theoretical risk on a researcher's slide deck. Criminals are using it in real intrusions now.
Our guide to how to check the CISA KEV catalogue explains how to track those confirmations yourself. Bugs on that list should jump to the front of your patching queue.
Who's at risk
Any organisation running Windows with Microsoft Defender, which is to say most organisations running Windows at all, since Defender ships built in and is the default for many. The exploitation reported so far has come after attackers already achieved some initial access through other means, so this is a mid-chain escalation tool rather than an entry point, but it's a well-used one.
Time matters here too. Security researchers have long observed that criminals can weaponise a published fix within days, sometimes hours, because comparing a patched file with its predecessor shows exactly what changed. A fix that sits uninstalled for 30 days is a long window.
Small firms are exposed too. They often lack a dedicated security team, rely on default settings and do not monitor update channels. Criminal groups know this and tend to prefer reliable, well-tested tools over exotic ones.
How it compares with other Windows problems
| Type of flaw | What it gives an attacker | Where it fits in an attack | How it is fixed |
|---|---|---|---|
| BlueHammer (Defender privilege escalation) | Full administrative control | Mid-chain, after initial access | Defender platform and engine update |
| Remote code execution bug | A first foothold | Entry point | Monthly Windows security update |
| Credential theft | Valid logins | Entry point or lateral movement | Password resets, patching, monitoring |
The pattern is worth understanding. Entry-point bugs tend to get the headlines, but escalation bugs decide how bad the incident gets. We saw the same dynamic when ShieldBreak turned out to be a Windows zero day that only works if Defender is switched on, and again in the FortiBleed credential theft that is now a confirmed ransomware pipeline.
What to do
Microsoft patches Defender through its own monthly platform and engine updates (KB4052623), separate from the main Windows cumulative updates, which trips people up. Open Windows Security, go to Settings, then About, and check the antimalware client (platform) version is from April 2026 or later; if not, run Windows Update or push the platform update through WSUS or Configuration Manager. It takes thirty seconds to check and it's worth doing on every managed machine in your organisation, not just your own.
Why the separate channel causes trouble
Most people think of Windows patching as one job. Microsoft's monthly release, known as Patch Tuesday, covers the operating system. Defender, however, updates its engine and platform components more often than that, and on its own schedule. Our write-up of Microsoft's biggest Patch Tuesday ever shows how much lands in the monthly cycle, and how easily a separate stream can slip past unnoticed.
The result is a dashboard that says "up to date" while a security component quietly runs an old build. That gap is exactly what attackers hope for.
A practical checklist for IT teams
- Check the Defender platform version on a sample of machines today, then roll the check out to the rest.
- Use WSUS, Configuration Manager or Intune to deploy Defender platform updates, rather than trusting each machine to fetch them.
- Confirm the Defender platform and engine versions in your inventory, not just the Windows build number.
- Look for signs of privilege escalation in logs: new administrator accounts, security tools being disabled and unusual service installs.
- Keep offline or immutable backups, so that a successful attack does not mean paying up.
The bigger picture on ransomware
Ransomware remains expensive once downtime, recovery and legal costs are counted.
Attackers also move fast. Once inside a network, some crews reach full administrative control within hours, and the escalation step is often the slowest part of the chain. Take it away and the whole operation gets harder.
That is why patching a privilege-escalation bug is not a minor housekeeping task. It removes one of the more dependable steps in the criminal playbook.
Defence in depth still applies
No single update will protect you. Limit administrator rights, segment networks, enable multi-factor authentication and watch for odd behaviour from security tools themselves. If Defender suddenly stops reporting, treat it as an alarm, not a glitch.
One patch-worthy story, explained simply, every Friday.
Key takeaways
- CISA has confirmed ransomware operators are exploiting CVE-2026-33825, nicknamed BlueHammer, in Microsoft Defender.
- It is a privilege-escalation bug used after initial access, not an entry point.
- Almost any organisation running Windows is exposed, because Defender is built in and the default for many.
- Defender updates through a separate channel from the main Windows security updates.
- Check the Defender platform version in Windows Security, under Settings then About, and update through Windows Update or your management tooling if it predates April 2026.
- The check takes thirty seconds and should be done on every managed machine.
