CISA Warns BlueHammer Flaw Is Now Exploited in Ransomware Attacks

CISA confirms the BlueHammer vulnerability (CVE-2026-33825) is being exploited in real-world ransomware attacks to gain SYSTEM privileges through Microsoft Defender; the flaw and two related zero-days were publicly disclosed by a researcher whose released proof-of-concept code is believed to be used by attackers, and CISA has added BlueHammer to its Known Exploited Vulnerabilities list.