Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

**Executive summary:** Huntress warns that threat actors are actively exploiting three zero-day flaws in Microsoft Defender—BlueHammer (CVE-2026-33825), RedSun, and UnDefend—leading to local privilege escalation and a DoS that can block updates; BlueHammer was patched by Microsoft but RedSun and UnDefend were observed exploited or with PoCs in the wild and remained unpatched at the time of the report.