ctrlINT What the industry said about every indicator, with the quote

CVE-2026-33825Vulnerability

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 4 independent sources · first reported by Huntress · last reported

Last reported 3 days ago

CISA KEVAdded 22 Apr 2026
Fix due 6 May 2026
Used by ransomware: knownCISA KEV catalogue
EPSS0.4%
higher than 33% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

4 reports, newest first · the exact sentence from each

  1. “BlueHammer (CVE-2026-33825) is an eight-stage local privilege-escalation chain targeting the Windows Defender Antimalware Platform before 4.18.26030.3011.”

    Qualys Threat ResearchVendor
    The Science of Exploitability: Decoding BlueHammer

  2. “The latest exploits follow the researcher's previous disclosure of the BlueHammer (CVE-2026-33825) and RedSun.”

    CERT-EUGovernment
    Cyber Brief 26-06 - May 2026

  3. “CVE-2026-33825”

    Recorded FutureVendor
    June 2026 CVE Landscape

  4. “As part of its April 2026 updates, Microsoft rolled out a patch for the BlueHammer vulnerability (tracked as CVE-2026-33825).”

    HuntressVendor
    Nightmare-Eclipse Tooling Seen in Real-World Intrusion

Indicators reported together

named in the same reports

Also named with it: CVE-2026-35616, CVE-2026-25089, CVE-2026-39808, CVE-2026-11645, CVE-2026-28318, CVE-2026-20230, CVE-2026-43284, CVE-2026-0300, CVE-2026-45585, CVE-2025-55182, CVE-2026-21509, CVE-2025-8088, CVE-2025-6218, CVE-2026-35273, CVE-2021-27137, CVE-2026-46817, CVE-2026-48907, CVE-2026-12569, CVE-2022-27925, CVE-2023-46747

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2026-33825 here?
No account needed. We do not store your IP address.