U.S. CISA adds a flaw in Microsoft Defender to its Known Exploited Vulnerabilities catalog

CISA added Microsoft Defender flaw CVE-2026-33825 (CVSS 7.8) to its Known Exploited Vulnerabilities catalog after reports that attackers are exploiting three recently disclosed Microsoft Defender vulnerabilities (BlueHammer, RedSun, UnDefend) to escalate privileges or disrupt protection; one flaw was patched in April 2026, public proof-of-concept exploit code was published, and federal agencies were ordered to remediate the issue by May 6, 2026.