Microsoft Defender under attack as three zero-days, two of them still unpatched, enable elevated access

Security researchers report that threat actors are exploiting three Microsoft Defender zero-days — BlueHammer, RedSun, and UnDefend — to gain elevated privileges and to disable security updates; BlueHammer (CVE-2026-33825) has been fixed but RedSun and UnDefend remain unpatched, public proof-of-concept code was released, and Huntress observed real-world exploitation beginning in April 2026.