Leaked Windows Defender 0-Day Vulnerability Actively Exploited in Attacks

Huntress reports active exploitation of three Windows Defender privilege-escalation techniques (BlueHammer CVE-2026-33825, RedSun, and UnDefend) using public PoC code to gain SYSTEM privileges; BlueHammer was patched in April 2026 while RedSun and UnDefend remain unpatched, with observed staging of binaries in user-writable directories, EICAR baiting, hands-on-keyboard reconnaissance, and recommended immediate patching and hunting for related artifacts.