BlueHammer, RedSun, UnDefend: Three Microsoft Defender Zero-Days Exploited Right Now — Two Still Without a Patch
🔍 The three flaws at a glance
Lets any user gain full control of a PC (SYSTEM level). CVE-2026-33825 — patched on 14 April 2026.
Same result as BlueHammer — SYSTEM access — via a different mechanism. Works even on a fully updated PC.
Prevents Defender from receiving updates. Your antivirus gradually goes blind — without you knowing.
😤 Why these flaws were made public
All three exploits were deliberately published on GitHub by an anonymous security researcher going by Nightmare Eclipse or Chaotic Eclipse. The reason: Microsoft ignored their vulnerability reports for weeks without a proper response.
By publishing the exploit code, they forced Microsoft's hand — but at the cost of exposing millions of users. BlueHammer was patched 11 days after publication. RedSun and UnDefend are still waiting for a fix.
📅 Timeline of events
- 3 Apr 2026BlueHammer publishedNightmare Eclipse releases the exploit code on GitHub after Microsoft ignored them
- 10 Apr 2026First exploitation detectedHuntress Labs observes BlueHammer used in real-world cyberattacks
- 14 Apr 2026Microsoft patches BlueHammerCVE-2026-33825 fixed via the April 2026 Patch Tuesday
- 16 Apr 2026RedSun and UnDefend publishedThe researcher releases two more flaws — still unpatched to this day
- 22 Apr 2026CISA issues alertUS cybersecurity agency orders federal agencies to patch before 7 May
- 26 Apr 2026RedSun and UnDefend still unpatchedMicrosoft has not announced a fix date for either vulnerability
⚠️ What does this actually mean?
Attackers are chaining the three flaws together. First BlueHammer or RedSun to gain full control of the PC, then UnDefend to blind Defender. Result: the attacker owns the machine and the antivirus can no longer detect them.
- All PCs running Windows 10 and Windows 11 with Microsoft Defender enabled
- Windows Server 2016 through 2025
- Even a fully updated PC remains vulnerable to RedSun and UnDefend
- Defender is enabled by default on virtually every Windows installation
✅ What you need to do right now
- Run Windows Update now — Settings → Windows Update → Check for updates. This patches BlueHammer
- Check your Defender version — it should be 4.18.26050.3011 or higher
- Add a third-party antivirus — Bitdefender alongside Defender protects against RedSun and UnDefend
- Watch for suspicious files — attackers hide exploits in Pictures and Downloads folders
- Watch for processes named FunnyApp.exe, RedSun.exe, undef.exe, z.exe in your logs
- Enable Attack Surface Reduction (ASR) rules in Windows Defender
- Monitor for anomalies in Defender signature updates
Is your PC protected?
Describe your setup to CyberGuard — it'll check with you in a few minutes.
🤖 Check with CyberGuard →