Critical Microsoft Defender Zero-Day Exploits: BlueHammer, RedSun, and UnDefend
In April 2026, a security researcher known as Chaotic Eclipse publicly disclosed three zero-day vulnerabilities in Microsoft Defender: BlueHammer, RedSun, and UnDefend. These exploits allow attackers to escalate privileges to SYSTEM level and disable Defender's update mechanism, effectively turning the security tool against its users. Microsoft has patched BlueHammer (CVE-2026-33825), but RedSun and UnDefend remain unpatched as of April 22, 2026. ([tomsguide.com](https://www.tomsguide.com/computing/online-security/over-1-billion-windows-users-at-risk-after-disgruntled-security-researcher-leaks-defender-zero-days?utm_source=openai)) The public release of these exploits has led to active exploitation in the wild, with threat actors leveraging them to gain elevated privileges and disable security defenses. This incident underscores the critical importance of timely vulnerability disclosure and patch management in maintaining organizational security. ([techcrunch.com](https://techcrunch.com/2026/04/17/hackers-are-abusing-unpatched-windows-security-flaws-to-hack-into-organizations?utm_source=openai))
Kill Chain
