Microsoft Defender Zero-Day “BlueHammer” Hits KEV Catalog Following Researcher’s Protest

CISA added CVE-2026-33825 (BlueHammer) to its Known Exploited Vulnerabilities catalog after evidence of active exploitation; the flaw in Microsoft Defender leverages TOCTOU and path confusion to obtain SAM password hashes and escalate to SYSTEM. A researcher released PoC code and Huntress Labs observed BlueHammer, RedSun, and UnDefend used in hands-on-keyboard attacks that begin from compromised SSL VPN credentials; Microsoft patched BlueHammer in April 2026 and CISA required FCEB remediation by May 6, 2026.