Exploits Turn Windows Defender into Attacker Tool

Three publicly released proof-of-concept exploits targeting Microsoft Defender — BlueHammer (CVE-2026-33825), RedSun, and UnDefend — abuse race conditions and unvalidated privileged file operations to escalate to SYSTEM and to impair Defender's update/health reporting; BlueHammer is patched by Microsoft's April 2026 update, while RedSun and UnDefend remain unassigned CVEs and have been observed in targeted, hands-on intrusions often following compromised VPN accounts. The report recommends applying updates, enforcing MFA on remote access, blocking execution from user-writable directories, and validating Defender component versions.