Microsoft Defender Under Attack: Three Zero-Day Vulnerabilities Exploited for Elevated Access

Attackers are exploiting three zero-day vulnerabilities in Microsoft Defender, code-named BlueHammer, RedSun, and UnDefend, to gain elevated privileges on compromised systems. The flaws were disclosed by a researcher known as Chaotic Eclipse, who criticized Microsoft’s handling of the issues. Two of the three vulnerabilities remain unpatched at the time of reporting, while specific CVE identifiers (including CVE-2026-33825) were mentioned. The attacks enable higher-level access on affected systems, though no exact exploitation timeline or affected versions were specified. The vulnerabilities were reported under the broader campaign names Chaotic Eclipse and Pierluigi Paganini.