Blue Hammer CVE-2026-33825: Defender LPE Explained | Qualys

Summary: BlueHammer (CVE-2026-33825) is an eight-stage local privilege-escalation chain affecting Windows Defender Antimalware Platform versions before 4.18.26030.3011, requiring standard-user code execution before it can run. In Qualys lab testing on Defender version 4.18.2104.10, the chain reached NT AUTHORITY\SYSTEM, recovered CITRIX\administrator credentials from LSASS, and authenticated to the domain controller via pass-the-hash to extract NTDS.dit.
What you should know: Qualys notes that affected is not the same as exploitable - pending signature updates, WinDefend state, filter drivers, VSS, and CloudFilter reachability decide whether the path works on a given host, a gap version-based scanning cannot close. A standard-user foothold on one endpoint was enough to yield verified domain-administrator control.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-33825
Related: CVE-2026-33825: Microsoft Defender Insufficient Granularity of Access Control Vulnerability Known Exploited Vulnerabilities · Apr 22, 2026
Patch Tuesday, April 2026 Edition Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026