Microsoft Defender is no longer just the target. A local user-level foothold can be turned into higher privilege on the same Windows machine, so the software meant to protect the host can become part of the path to taking it over.
CISA now says ransomware gangs are exploiting CVE-2026-33825, after earlier zero-day abuse of the same BlueHammer flaw. The bug lets an attacker who already has ordinary access on the computer get the software to grant more power than they should have, which changes a small compromise into admin-level control on that box.
That shifts the problem from a patched vulnerability to a reusable post-exploitation step. For Windows fleets, the danger is not the initial break-in alone; it is how fast one compromised session can become elevated control for defense evasion and ransomware deployment.