Vulnerabilities & Exploits
Qualys analyzed BlueHammer, an eight-stage local privilege-escalation chain that reached SYSTEM from a standard-user foothold in its lab; CVE-2026-33825 affects Microsoft Defender Antimalware Platform versions before 4.18.26030.3011. The chain does not provide initial access.
BlueHammer abuses Defender’s privileged update and file-handling paths: carefully timed file operations can make a high-privilege service act across the user boundary. Reachability depends on host conditions, including a pending signature update, Defender service state, filter drivers, Volume Shadow Copy (VSS), and CloudFilter access. Qualys recovered credentials from the Local Security Authority Subsystem Service (LSASS) in its lab, but version status alone cannot show whether the chain works on a particular machine.
For a Windows endpoint with a standard-user foothold, a vulnerable version identifies a possible path to SYSTEM, not proof the host can follow it. Qualys’s non-destructive validation checks the CloudFilter freeze primitive but stops before credential extraction or later stages.
1 source · 9h ago
Known exploited · CISA KEV
CVSS 7.8 HIGH: insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges… Microsoft patch: Release Notes.
CISA federal remediation date May 6 · date passed
Qualys
BlueHammer CVE-2026-33825: Defender LPE Explained | Qualys
BlueHammer is an eight-stage Windows Defender LPE (CVE-2026-33825).
originalPart of the PlainSec briefing for 2026-10-21
Every edition of this story: BlueHammer can turn Windows user access into SYSTEM