BlueHammer: Researcher Drops Functional 0-Day Exploit Targeting Windows Defender

A researcher publicly disclosed "BlueHammer", a functional zero-day local privilege escalation that abuses Windows Defender's internal signature update (IMpService) to redirect SYSTEM-context operations into attacker-controlled locations. The PoC uses NTFS junctions/undocumented NT APIs, in-memory tampering of legitimate updates, and a TOCTOU race won via Cloud Files API and Volume Shadow Copy primitives; independent analysts have verified the exploit but it remains unpatched and may not work on all Windows Server versions. Administrators are advised to monitor IMpService RPC activity and unauthorized NTFS junction creations until Microsoft issues a fix.