The security tool millions of Windows machines trust to catch malware turned out to have its own privilege-escalation problem, and criminals noticed. Microsoft Defender’s CVE-2026-33825, nicknamed BlueHammer by the researchers who tracked it, lets a low-privileged local attacker claw their way up to SYSTEM, the highest access level on Windows. Microsoft patched it on April 14, 2026, roughly a week after a researcher released a working exploit publicly instead of reporting it quietly.
