CVE-2026-33825: Microsoft Defender Insufficient Granularity of Access Control Vulnerability
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
Overview
Microsoft Defender Antimalware Platform contains a local privilege escalation flaw stemming from insufficiently granular access controls around its file-scanning and Volume Shadow Copy operations. An attacker with a low-privileged local account can exploit a race condition to obtain an arbitrary read handle to the Security Account Manager (SAM) database, reaching SYSTEM-level privileges. Versions below 4.18.26030.3011 are affected. This vulnerability is tracked as BlueHammer by the Nightmare-Eclipse researcher and has been observed in active intrusions, including use alongside credential dumping and lateral movement activity.
Vulnerability details
Windows Defender's access controls do not apply sufficient granularity to the file handles it exposes during scan and remediation operations. The underlying weakness is a Time-of-Check, Time-of-Use (TOCTOU) race condition: Defender checks a file's state, then acts on it, and the gap between those two moments is normally too narrow to exploit reliably. BlueHammer closes that gap by pausing Defender with its Volume Shadow Copy open, giving an attacker direct control over the timing of the race window. The attacker uses oplock-based monitoring to detect when Defender is actively scanning or remediating, then intervenes at the precise moment the VSS is exposed.
Once the race window is held open, the attacker's local exploit binary races to obtain an arbitrary read handle to the SAM database, which stores Windows credential material. From that position, the attacker can dump credential hashes, establish persistence under SYSTEM context, and blend into normal system activity while moving laterally through the environment. The preconditions are a low-privileged local account, the ability to stage and execute binaries in user-writable directories, and a Defender Antimalware Platform version below 4.18.26030.3011. Huntress has confirmed this technique was used in real-world intrusions, and CISA has added it to the Known Exploited Vulnerabilities catalog with known ransomware use.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Look for binaries staged in user-writable directories (such as %TEMP%, %APPDATA%, or user profile subdirectories) that create oplock handles against Defender-monitored paths or invoke Volume Shadow Copy APIs without a matching backup or restore event.
- Monitor Windows Security event logs and Sysmon for processes running under a low-privileged user context that spawn children or open handles to SAM (registry path HKLM\SAM or the SAM hive file) without a corresponding administrative session or credential-manager operation.
- Alert on unexpected SYSTEM-level process creation or token impersonation events originating from a non-SYSTEM parent process, particularly where the parent was staged in a user-writable directory and has no software inventory match.
Remediation
Additional hardening
- Update Microsoft Defender Antimalware Platform to version 4.18.26030.3011 or later; Defender typically updates automatically via Windows Update, but verify the platform version in Windows Security settings, particularly on air-gapped or managed endpoints where automatic updates may be delayed.
- Restrict local interactive and remote logon rights to only accounts that require them; a low-privileged local account is a required precondition, so reducing the pool of accounts with local logon access directly limits exposure.
- Apply application control policies (such as Windows Defender Application Control or AppLocker) to block execution of unsigned or unrecognized binaries from user-writable directories, which is the staging path observed in confirmed intrusions.
- Audit Volume Shadow Copy creation events (Event ID 8222 or VSS provider logs) for unexpected VSS snapshots not associated with scheduled backups, as BlueHammer's mechanism depends on pausing Defender with a VSS open.
Key dates
References
Frequently asked questions
Does CVE-2026-33825 affect my FedRAMP authorization?
If Microsoft Defender runs inside your authorization boundary, yes. CVE-2026-33825 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of May 6, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can already see. Your options now are to remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-33825?
Knox does not patch your software. Remediating Microsoft Defender is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus continuous compliance monitoring and audit-artifact coverage to help you document the fix for your next assessment. The fix belongs to you; maintaining a compliant posture while you apply it is not something you have to manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a case like CVE-2026-33825, that means exposure surfaces during continuous monitoring rather than only when an assessor flags it at review time, giving your team earlier visibility into what needs to be addressed.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-33825's remediation deadline of May 6, 2026 has passed. What happens now?
If CVE-2026-33825 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing the finding out and documenting why the deadline was missed is what keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
