Executive Summary
In April 2026, a critical zero-day vulnerability in Microsoft Defender, tracked as CVE-2026-33825, was disclosed alongside multiple functional exploits. The vulnerability, which carries a CVSS score of 7.8, stems from a race condition in Defender's file remediation and cloud-file rollback logic. This allows local, unprivileged attackers to manipulate file operations and gain SYSTEM-level access on fully patched Windows 10, Windows 11, and Windows Server systems.
The attack chain involves three primary exploits: BlueHammer, which uses opportunistic locks (oplocks) and NTFS junctions to redirect file writes; RedSun, which abuses cloud-tagged file restoration for the same purpose; and UnDefend, which focuses on degrading Defender's update mechanisms. These exploits demonstrate systemic architectural weaknesses in how Defender handles privileged file operations during malware cleanup.
This threat is of high urgency for organizations as it weaponizes the security product itself to facilitate lateral movement and persistence. While Microsoft released patches in April 2026, the public availability of proof-of-concept code and the ability to bypass security controls by overwriting system binaries in C:\Windows\System32 pose a significant risk to all Windows-based infrastructure.