Exploitation of Microsoft Defender Vulnerabilities Raises Security Concerns

Recent reports indicate that hackers have exploited three unpatched vulnerabilities in Microsoft Defender, identified as BlueHammer, UnDefend, and RedSun. These vulnerabilities were disclosed by a security researcher known as Chaotic Eclipse, who published exploit code online, prompting immediate concerns within the cybersecurity community. The cybersecurity firm Huntress has confirmed that these flaws have been actively exploited in at least one organization, with BlueHammer being the only vulnerability that has received a patch from Microsoft as of now.

TechCrunchThree Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

The vulnerabilities affect Microsoft Defender, allowing attackers to gain elevated privileges on compromised systems. BlueHammer and RedSun are classified as local privilege escalation (LPE) flaws, while UnDefend can trigger a denial-of-service (DoS) condition, preventing essential updates. Microsoft has addressed BlueHammer under the CVE identifier CVE-2026-33825, but no fixes are currently available for RedSun and UnDefend.

Three Microsoft Defender Zero-Days Actively Exploited; Two Still UnpatchedTechCrunch

• April 10, 2026: BlueHammer begins to be weaponized by hackers.

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

• April 16, 2026: Exploits for RedSun and UnDefend are observed in the wild.

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

• April 17, 2026: Huntress reports the exploitation of all three vulnerabilities.

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

Microsoft's communications director, Ben Hope, emphasized the importance of coordinated vulnerability disclosure, stating that it helps ensure vulnerabilities are investigated and addressed before public disclosure. This approach aims to protect customers and support the security research community. However, the situation has raised questions about the effectiveness of this process, particularly when researchers like Chaotic Eclipse feel compelled to disclose vulnerabilities publicly due to perceived inadequacies in communication with Microsoft.

TechCrunch

Critics of the disclosure process highlight the risks associated with publicizing exploit code. John Hammond, a researcher at Huntress, noted that the availability of such code allows cybercriminals to quickly weaponize vulnerabilities, leading to a "tug-of-war" between cybersecurity defenders and attackers. This dynamic creates a race against time for defenders to secure systems against rapidly evolving threats.

TechCrunch

While Huntress has confirmed the exploitation of these vulnerabilities, details regarding the specific organizations targeted and the extent of the breaches remain unclear. Additionally, the lack of fixes for RedSun and UnDefend raises concerns about ongoing vulnerabilities that could be exploited further.

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

“Scenarios like these cause us to race with our adversaries; defenders frantically try to protect against ill-intended actors who rapidly take advantage of these exploits…” — John Hammond, Researcher at Huntress

TechCrunch

“I was not bluffing Microsoft and I’m doing it again,” — Chaotic Eclipse, Security Researcher

TechCrunch

The exploitation of the vulnerabilities in Microsoft Defender underscores significant challenges in the cybersecurity landscape, particularly regarding the disclosure and patching of security flaws. As the situation develops, the effectiveness of coordinated vulnerability disclosure practices will be scrutinized, and the cybersecurity community will continue to monitor the implications of these exploits.

TechCrunch