CVE-2026-33825

Name of the Vulnerable Software and Affected Versions microsoft defender antimalware platform versions prior to 4.18.26030.3011

Description Insufficient granularity of access control in Microsoft Defender allows an authorized local attacker to elevate privileges to SYSTEM level. This issue, dubbed BlueHammer, involves a time-of-check to time-of-use (TOCTOU) race condition within the signature update and remediation workflow. The exploit chains the Windows Cloud Files API, Opportunistic Locks (Oplocks), and Volume Shadow Copy (VSS) to pause the system during a snapshot creation. This allows the attacker to access normally locked registry hives, such as SAM, SYSTEM, and SECURITY, to extract local administrator hashes and spawn a shell as NT AUTHORITYSYSTEM without triggering User Account Control (UAC) or leaving logs. The flaw has been actively exploited as a zero-day by ransomware groups to disable endpoint protection and deliver payloads. Some incidents have been linked to compromised FortiGate SSL VPN connections with IP addresses geolocated in Russia.

Recommendations Update the Defender platform to version 4.18.26030.3011 or higher. Use Group Policy to restrict the Volume Shadow Copy Service to specific administrative users only. Monitor for any process calling vssvc.exe that is not a known backup tool. Audit logs for unusual CldFlt (Cloud Files Mini Filter) activity originating from non-system directories.