CISA Reports Ransomware Exploits Defender BlueHammer

A critical vulnerability in Microsoft Defender, known as BlueHammer, is now being actively exploited by ransomware groups, according to a recent update from the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The flaw, tracked as CVE-2026-33825, is a privilege escalation vulnerability that allows an authenticated attacker to gain higher-level system access.

The agency added the vulnerability to its Known Exploited Vulnerabilities catalog on April 22 and has now updated that entry to specify its use in ransomware campaigns. Microsoft had previously patched the flaw on April 14, describing it in an advisory as a local privilege escalation issue where exploitation was "more likely." The company has not officially confirmed active exploitation.

Security researchers from Huntress reported observing the vulnerability being exploited as a zero-day before Microsoft's patch was available, with attacks incorporating the exploit beginning around April 10. The attacks showed evidence of hands-on activity by threat actors, though the specific ransomware group or victims involved have not been publicly identified.

The vulnerability was first publicly disclosed on April 2 by a...