Recently leaked Windows zero-days now exploited in attacks

Threat actors are actively exploiting three recently disclosed Windows zero-day vulnerabilities—BlueHammer (patched as CVE-2026-33825), RedSun, and UnDefend—after a researcher released proof-of-concept exploit code. Huntress Labs observed RedSun and UnDefend used on compromised systems to gain SYSTEM privileges and block Defender updates, with evidence of hands-on-keyboard activity; BlueHammer has been patched but RedSun and UnDefend remained unaddressed at the time of the report.