What Happened
On April 14, 2026, Microsoft released its Patch Tuesday updates addressing over 160 vulnerabilities, including two zero-day flaws in Windows Defender. Within days, security researchers revealed that a total of three distinct zero-day vulnerabilities in Microsoft Defender were being actively exploited in the wild — with two remaining unpatched as of late April. (SecurityWeek)
The disclosure triggered an emergency directive from CISA, ordering federal agencies to patch the BlueHammer vulnerability within 72 hours. The flaws allow attackers to bypass Microsoft's built-in antivirus protection entirely, granting full system access on compromised machines. (BleepingComputer)
Technical Analysis
The three zero-days — named BlueHammer, RedSun, and UnDefend — target different components of the Windows Defender ecosystem but share a common goal: disabling real-time protection to deploy malware undetected. (Help Net Security)
CVE-2026-33825 is the identifier tied to both BlueHammer and RedSun vulnerabilities. This flaw exploits a race condition in the Windows Defender update verification process, allowing a local attacker to inject malicious code during the signature update cycle. The attack achieves SYSTEM-level privileges by hijacking the MpDefenderCore service. The third vulnerability, UnDefend, targets the Windows Security GUI component, enabling attackers to manipulate the user interface and hide disabled protection status from administrators. All three flaws affect Windows 10 and Windows 11 systems running Microsoft Defender with real-time protection enabled.
Who's Affected
The attack surface is enormous. Microsoft Defender ships pre-installed on over 1 billion Windows devices worldwide, making this one of the most significant security incidents of 2026. While Microsoft patched BlueHammer and RedSun in the April 14 Patch Tuesday, the UnDefend vulnerability remains unpatched as of April 21. (SecurityWeek)
Federal agencies in the United States face the most immediate risk. CISA's emergency directive applies to all civilian executive branch agencies, requiring patching within 72 hours of the advisory. However, the private sector and international organizations remain exposed until Microsoft releases a complete fix.
How to Protect Yourself
- Apply the April 2026 Patch Tuesday updates immediately — this addresses BlueHammer and RedSun. Verify the update status via Windows Update or your patch management console.
- Monitor for disabled real-time protection — use PowerShell commands or SIEM rules to alert when the Windows Security center reports protection as disabled or expired.
- Implement application control policies — restrict execution of unsigned binaries in sensitive directories to limit the impact of a successful exploit.
- Deploy additional endpoint detection — consider third-party EDR solutions as a compensating control while the Defender vulnerabilities remain partially unpatched.
- Audit privileged accounts — the BlueHammer exploit requires local access, so limiting admin privileges reduces the attack chain feasibility.
The Sable Angle
These vulnerabilities underscore a uncomfortable truth: even the security tools we trust most can become attack vectors. At Sable, our offensive security team has spent years demonstrating how endpoint protection can be turned against users. The BlueHammer and RedSun flaws are textbook examples of the kind of vulnerabilities we identify during red team engagements — flaws that exist not because of unknown unknowns, but because defenders assume their tools are trustworthy.
Our research into Windows Defender internals has contributed to the broader security community's understanding of these attack surfaces. We believe that transparent disclosure — even when uncomfortable for vendors — ultimately strengthens defensive capabilities. Organizations that wait for vendor patches alone will always be one step behind. Proactive threat hunting, regular red team exercises, and defense-in-depth architecture are the only sustainable path forward.