Researcher Discloses Three Microsoft Defender Zero-Days

A security researcher known as Chaotic Eclipse has publicly disclosed proof-of-concept exploits for three zero-day vulnerabilities in Microsoft Defender, prompting warnings from cybersecurity firms about active exploitation in the wild. The disclosures, which began on April 3, 2026, targeted flaws that allow attackers to escalate privileges and disrupt the antivirus software's updates, affecting Windows 10, Windows 11, and Windows Server 2019 and later systems.

The first vulnerability, dubbed BlueHammer, enables local privilege escalation by exploiting a race condition in the Windows Defender signature update process. It involves interactions between the Volume Shadow Copy Service, Cloud Files API, and opportunistic locking to access protected resources, ultimately extracting password hashes from the Security Account Manager database. This allows an attacker with initial device access to gain NT AUTHORITY\SYSTEM privileges and launch a shell with full control. The exploit includes a cleanup routine to restore original password hashes, evading detection. BlueHammer was published on GitHub, where it quickly gained traction among users.

Huntress researchers reported observing...