Windows systems running Microsoft Defender are facing active cyberattacks as hackers exploit newly disclosed vulnerabilities to gain deeper access.
Quick Summary – TLDR:
- Three vulnerabilities in Microsoft Defender are being actively exploited by hackers.
- Only one flaw has been patched, while others remain exposed.
- Public release of exploit code has accelerated real world attacks.
- Affected systems include Windows 10, Windows 11, and Windows Server.
What Happened?
Cybersecurity researchers have confirmed that multiple flaws in Microsoft Defender are being actively used by attackers to compromise systems. The vulnerabilities were publicly disclosed along with exploit code, making it easier for threat actors to launch attacks.
At least one organization has already been breached using these flaws, raising concerns about widespread risk across Windows environments.
🚨 Three Windows zero-days released by Nightmare-Eclipse are being used in the wild by threat actors.
— International Cyber Digest (@IntCyberDigest) April 17, 2026
BlueHammer (CVE-2026-33825): LPE, Abuses Windows Defender’s signature-update pipeline and VSS to breach protected registry hives, dump SAM hashes/identities, and escalate… pic.twitter.com/bYb2we2imI
Multiple Defender Flaws Now in Active Use
Security researchers have identified three major vulnerabilities impacting Microsoft Defender. These include BlueHammer, RedSun, and UnDefend, all of which were disclosed as zero-day flaws by a researcher known as Chaotic Eclipse.
- BlueHammer allows local privilege escalation and has now been patched by Microsoft under CVE-2026-33825.
- RedSun is another privilege escalation flaw that remains unpatched.
- UnDefend can disable security updates by triggering a denial of service condition.
According to Huntress, attackers have already begun exploiting all three vulnerabilities in real world environments. The firm observed suspicious activity involving commands such as system enumeration and credential checks, indicating hands on keyboard attacks by threat actors.
How the RedSun Exploit Works?
The RedSun vulnerability highlights a serious flaw in how Microsoft Defender handles flagged files. Instead of removing certain malicious files, the antivirus may restore them to their original location under specific conditions.
This behavior can be abused by attackers to overwrite critical system files and gain administrative privileges without detection. Once elevated access is achieved, attackers can take full control of the system, install malware, or move laterally across networks.
The researcher behind the discovery criticized this behavior, stating that antivirus software should remove threats rather than unintentionally preserve them.
Public Disclosure Fuels Faster Attacks
The situation escalated after the researcher published proof of concept exploit code online. This approach, known as full disclosure, can sometimes push vendors to act faster but also gives cybercriminals immediate access to working attack tools.
In this case, the publicly available code has already been weaponized. Hackers are using it to target vulnerable systems, significantly lowering the barrier to entry for attacks.
John Hammond from Huntress described the situation as a race between defenders and attackers, noting that ready made exploit tools allow threat actors to move quickly.
Microsoft Response and Patch Status
Microsoft has confirmed that it has patched the BlueHammer vulnerability, but RedSun and UnDefend remain without fixes at the time of writing.
The company stated that it follows coordinated vulnerability disclosure practices, which aim to ensure security issues are addressed before they are made public. However, the current case highlights what can happen when that process breaks down.
The vulnerabilities affect systems running Windows 10, Windows 11, and Windows Server, especially where Microsoft Defender is actively used.
Growing Risks for Organizations
With exploit code already circulating and active attacks confirmed, organizations face increased risk of compromise.
Key concerns include:
- Privilege escalation leading to full system control.
- Disruption of security updates and protections.
- Rapid spread of attacks due to publicly available tools.
Security experts are advising users and organizations to remain vigilant and consider layered security approaches until patches are released.
SQ Magazine’s Takeaway
I think this situation shows how fragile the balance is between researchers and big tech companies. When communication breaks down, it is not just a disagreement behind closed doors, it turns into real world risk for millions of users. The fact that working exploit code is already out there and being used is worrying. If you rely only on default protection, this is a clear reminder that it might not always be enough.
