Vulnerabilities · 8h ago

BlueHammer can turn Windows user access into SYSTEM

Qualys analyzed BlueHammer, an eight-stage local privilege-escalation chain that reached SYSTEM from a standard-user foothold in its lab; CVE-2026-33825 affects Microsoft Defender Antimalware Platform versions before 4.18.26030.3011. The chain does not provide initial access.

BlueHammer abuses Defender’s privileged update and file-handling paths: carefully timed file operations can make a high-privilege service act across the user boundary. Reachability depends on host conditions, including a pending signature update, Defender service state, filter drivers, Volume Shadow Copy (VSS), and CloudFilter access. Qualys recovered credentials from the Local Security Authority Subsystem Service (LSASS) in its lab, but version status alone cannot show whether the chain works on a particular machine.

For a Windows endpoint with a standard-user foothold, a vulnerable version identifies a possible path to SYSTEM, not proof the host can follow it. Qualys’s non-destructive validation checks the CloudFilter freeze primitive but stops before credential extraction or later stages.

CVE-2026-33825

NVD KEV

Known exploited · CISA KEV

CVSS 7.8 HIGH: insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges… Microsoft patch: Release Notes.

CISA federal remediation date May 6 · date passed

Timeline

Oct 21 Reported by Qualys
May 6 CISA federal deadline for CVE-2026-33825 passed
Apr 22 CVE-2026-33825 added to CISA KEV

Sources

1 source covering this story

Qualys Oct 21
BlueHammer CVE-2026-33825: Defender LPE Explained | Qualys
BlueHammer is an eight-stage Windows Defender LPE (CVE-2026-33825).

Entities

CVE-2026-33825

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-10-21

Editions

Briefing for 2026-10-21

Vulnerabilities · 8h agoBlueHammer can turn Windows user access into SYSTEMQualys analyzed BlueHammer, an eight-stage local privilege-escalation chain that reached SYSTEM from a standard-user foothold in its lab; CVE-2026-33825 affects Microsoft Defender Antimalware Platform versions before 4.18.26030.3011. The chain does not provide initial access.BlueHammer abuses Defender’s privileged update and file-handling paths: carefully timed file operations can make a high-privilege service act across the user boundary. Reachability depends on host conditions, including a pending signature update, Defender service state, filter drivers, Volume Shadow Copy (VSS), and CloudFilter access. Qualys recovered credentials from the Local Security Authority Subsystem Service (LSASS) in its lab, but version status alone cannot show whether the chain works on a particular machine.For a Windows endpoint with a standard-user foothold, a vulnerable version identifies a possible path to SYSTEM, not proof the host can follow it. Qualys’s non-destructive validation checks the CloudFilter freeze primitive but stops before credential extraction or later stages.

CVE-2026-33825

NVD KEV

Known exploited · CISA KEV

CVSS 7.8 HIGH: insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges… Microsoft patch: Release Notes.