CISA Warns BlueHammer Flaw Is Now Exploited in Ransomware Attacks

A critical vulnerability known as BlueHammer, tracked as CVE-2026-33825, has been exploited in ransomware attacks, allowing attackers to gain SYSTEM privileges through Microsoft Defender. This escalation of privileges enables malicious actors to carry out local attacks, leveraging the vulnerability to compromise systems. The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that BlueHammer is now being used in active ransomware attacks¹. The vulnerability was initially disclosed by a researcher known as Chaotic Eclipse, along with two other zero-days, RedSun and UnDefend, after criticizing Microsoft's handling of the disclosure. The exploitation of CVE-2026-33825 signifies a shift from proof-of-concept to real-world attacks, making it a pressing concern for security practitioners. This development matters to security professionals because it necessitates immediate attention to patch or monitor the vulnerability, given its active exploitation in ransomware attacks.