CISA Mandates Patch for BlueHammer Windows Flaw in Two Weeks
CISA has ordered U.S. federal agencies to patch CVE-2026-33825, a Microsoft Defender privilege-escalation flaw nicknamed BlueHammer that was exploited as a zero-day before Microsoft released a fix on April 14. Agencies have two weeks (until May 7) to secure Windows systems, with CISA warning of ongoing exploitation and advising mitigations or product discontinuation if fixes aren’t available. The report also notes related flaws (RedSun, UnDefend) disclosed by Chaotic Eclipse and evidence of active intrusion including hands-on-keyboard activity and suspicious FortiGate VPN activity tied to Russia. CISA added the flaw to the Known Exploited Vulnerabilities catalog and highlighted broader risks from similar Windows zero-days.
- CISA orders feds to patch BlueHammer flaw exploited as zero-day BleepingComputer
- Exploits Turn Windows Defender Into Attacker Tool Dark Reading
- Hackers Use Nightmare-Eclipse Tools After Compromising FortiGate SSL VPN Access CyberSecurityNews
- Unpatched Microsoft Defender Flaw Lets Hackers Gain Admin Access on Windows extremetech.com
- Recent Microsoft Defender Vulnerability Exploited as Zero-Day SecurityWeek
Reading Insights
0
20
3 min
vs 4 min read
84%
654 → 103 words
Want the full story? Read the original article
Read on BleepingComputer