CISA Says Ransomware Gangs Are Exploiting Windows BlueHammer Flaw
Summary
CISA says ransomware gangs are exploiting BlueHammer (CVE-2026-33825), a Microsoft Defender local privilege-escalation flaw previously exploited as a zero-day. Microsoft patched it April 14; CISA added it to KEV and flagged ransomware use.
Key points
- CISA flagged CVE-2026-33825, known as BlueHammer, as exploited in ransomware campaigns.
- The Microsoft Defender flaw lets an authorized local attacker access the SAM database and potentially escalate to SYSTEM privileges.
- Researcher Nightmare Eclipse leaked the vulnerability with proof-of-concept code in early April.
- Huntress researchers had previously reported zero-day exploitation, including evidence of hands-on-keyboard activity.
- Microsoft patched the flaw on April 14, 2026; CISA added it to the KEV Catalog on April 22 and set a May 7 patch deadline for affected federal agencies.
- Microsoft had not independently tagged the flaw as exploited in attacks, according to the article.
Article Details
- Vulnerability Types
- Local privilege escalation
- Insufficient granularity of access control
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
CVE
People
Vendors
Products
Microsoft Defender Antimalware PlatformCISA said ransomware gangs are now exploiting the Microsoft Defender privilege escalation flaw BlueHammer (CVE-2026-33825), which had already been used in zero-day attacks.Microsoft WindowsThe vulnerability was leaked with proof-of-concept code by researcher “Nightmare Eclipse,” and it can lead attackers from local access to full SYSTEM control on Windows devices.