Windows 14 April 2026 - 18 April 2026

REDMOND, Washington, April 18, 2026, 09:31 PDT Three fresh Microsoft Defender vulnerabilities have already been put to work by attackers, raising alarm over public exploit code that flips a core Windows security tool into a threat itself. Huntress analysts spotted BlueHammer, RedSun, and UnDefend binaries stashed in a user’s Pictures and Downloads directories—these files appeared after the initial breach, traced back to a FortiGate VPN.

Microsoft issued a fix for CVE-2026-33825 on Tuesday, a Microsoft Defender privilege-escalation bug that had been publicly disclosed and linked by security researchers to BlueHammer, the proof-of-concept exploit that surfaced online earlier this month. That patch landed as part of Microsoft’s April Patch Tuesday update, which also included a security fix for SharePoint—CVE-2026-32201. According to Microsoft, attackers had already started exploiting that SharePoint vulnerability. This one’s significant: BlueHammer allowed attackers with existing access to escalate to SYSTEM, the highest level on Windows machines. With public exploit code out before any patch was ready, the debate among researchers quickly took a back seat. Suddenly, every unpatched endpoint faced a real threat.