Recently leaked Windows zero-days now exploited in attacks
Three Windows zero-days disclosed by researcher are now actively exploited in attacks.
Summary
Threat actors are exploiting three recently disclosed Windows security vulnerabilities (BlueHammer, RedSun, and UnDefend) that were leaked by a researcher known as 'Chaotic Eclipse' in protest of Microsoft's disclosure handling. BlueHammer has been patched in April 2026 updates and is tracked as CVE-2026-33825, but RedSun and UnDefend remain unpatched and allow attackers to gain SYSTEM privileges or disable Microsoft Defender. Huntress Labs confirmed all three exploits are being actively deployed in the wild, including in a breach involving a compromised SSLVPN user.
Full text
Recently leaked Windows zero-days now exploited in attacks By Sergiu Gatlan April 17, 2026 02:14 AM 0 Threat actors are exploiting three recently disclosed Windows security vulnerabilities in attacks aimed at gaining SYSTEM or elevated administrator permissions. Since the start of the month, a security researcher known as "Chaotic Eclipse" or "Nightmare-Eclipse" has published proof-of-concept exploit code for all three security issues in protest to how Microsoft's Security Response Center (MSRC) handled the disclosure process. Two of the vulnerabilities (dubbed BlueHammer and RedSun) are Microsoft Defender local privilege escalation (LPE) flaws, while the third (known as UnDefend) can be exploited as a standard user to block Microsoft Defender definition updates. At the time of the leak, the security flaws these exploits targeted were considered zero-days by Microsoft's definition, since they had no official patches or updates to address them. On Thursday, Huntress Labs security researchers reported seeing all three zero-day exploits deployed in the wild, with the BlueHammer vulnerability being exploited since April 10. They also spotted UnDefend and RedSun exploits on a Windows device that was breached using a compromised SSLVPN user, in attacks showing evidence of "hands-on-keyboard threat actor activity." "The Huntress SOC is observing the use of Nightmare-Eclipse's BlueHammer, RedSun, and UnDefend exploitation techniques," the researchers said. Two zero-days still waiting for a patch While Microsoft is now tracking the BlueHammer vulnerability as CVE-2026-33825 and has patched it in the April 2026 security updates, the other two flaws remain unaddressed. As BleepingComputer previously reported, attackers can use the RedSun exploit to gain SYSTEM privileges on Windows 10, Windows 11, and Windows Server 2019 and later systems when Windows Defender is enabled, even after applying the April Patch Tuesday patches. "When Windows Defender realizes that a malicious file has a cloud tag, for whatever stupid and hilarious reason, the antivirus that's supposed to protect decides that it is a good idea to just rewrite the file it found again to it's original location," the researcher explained. "The PoC abuses this behaviour to overwrite system files and gain administrative privileges." "Microsoft has a customer commitment to investigate reported security issues and update impacted devices to protect customers as soon as possible," a Microsoft spokesperson told BleepingComputer earlier this week when contacted for more information on the disclosure issues reported by the anonymous researcher. "We also support coordinated vulnerability disclosure, a widely adopted industry practice that helps ensure issues are carefully investigated and addressed before public disclosure, supporting both customer protection and the security research community." 99% of What Mythos Found Is Still Unpatched. AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what's exploitable, proves controls hold, and closes the remediation loop. Claim Your Spot Related Articles: New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privilegesCISA flags Windows Task Host vulnerability as exploited in attacksMicrosoft: April updates trigger BitLocker key prompts on some serversDisgruntled researcher leaks “BlueHammer” Windows zero-day exploitMicrosoft: April Windows Server 2025 update may fail to install
Indicators of Compromise
- cve — CVE-2026-33825
- malware — BlueHammer
- malware — RedSun
- malware — UnDefend