Three Microsoft Defender zero-days actively exploited, two remain unpatched

Cybersecurity firm Huntress reports active exploitation of three zero-day vulnerabilities in Microsoft Defender, with threat actors leveraging the flaws to gain elevated system privileges. The vulnerabilities, codenamed BlueHammer, RedSun, and UnDefend, were publicly disclosed by researcher Chaotic Eclipse following disputes with Microsoft's vulnerability disclosure process. BlueHammer and RedSun enable local privilege escalation within Microsoft Defender, while UnDefend can trigger denial-of-service conditions that block security definition updates. Microsoft addressed BlueHammer, tracked as CVE-2026-33825, in recent Patch Tuesday updates. However, RedSun and UnDefend remain unpatched at publication time. Huntress observed in-the-wild exploitation beginning with BlueHammer on April 10, followed by RedSun and UnDefend proof-of-concept deployments on April 16. The security vendor noted attacker activity including enumeration commands like whoami /priv, cmdkey /list, and net group, indicating hands-on-keyboard operations rather than automated attacks. The company has isolated affected systems to contain post-exploitation activity. Microsoft has not yet commented on the ongoing exploitation or patching timeline for the remaining vulnerabilities. These Defender flaws join a growing list of security issues affecting Microsoft products, highlighting challenges in enterprise endpoint protection maintenance and timely vulnerability response.