Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

Microsoft Defender's three zero-day vulnerabilities (BlueHammer, RedSun, and UnDefend) are being actively exploited by threat actors in the wild.

• •BlueHammer and RedSun are local privilege escalation (LPE) flaws that allow threat actors to gain elevated privileges on compromised systems
• •UnDefend enables denial-of-service (DoS) attacks and blocks security definition updates
• •BlueHammer was patched in Microsoft's Patch Tuesday updates (CVE-2026-33825); RedSun and UnDefend remain unpatched as of the article's writing
• •Exploitation began on April 10, 2026 with BlueHammer, followed by RedSun and UnDefend PoC exploits on April 16
• •Threat actors used enumeration commands (whoami /priv, cmdkey /list, net group) indicating active hands-on-keyboard attack activity