The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive requiring U.S. Federal Executive Branch (FCEB) agencies to patch a high-severity Microsoft Defender privilege escalation vulnerability, tracked as CVE-2026-33825 (“BlueHammer”), within two (2) weeks following confirmed zero-day exploitation in the wild. The flaw enables low-privileged attackers to gain SYSTEM-level access due to improper access control granularity and was patched by Microsoft on April 14, 2026, after public disclosure and proof-of-concept release by a researcher known as “Chaotic Eclipse,” who also revealed two (2) additional Defender-related zero-days (“RedSun” and “UnDefend”). Security researchers at Huntress Labs observed real-world attacks involving hands-on-keyboard activity, indicating broader intrusion campaigns rather than isolated testing, with evidence pointing to suspicious infrastructure, including FortiGate SSL VPN access and a Russia-linked IP. In response, CISA added CVE-2026-33825 to its Known Exploited Vulnerabilities (KEV) catalog under, mandating remediation by no later than May 7, 2026, and warning of the significant risk posed to federal systems. The alert follows a separate CISA warning about another actively exploited Windows privilege escalation flaw (CVE-2025-60710), underscoring a growing trend of attackers leveraging local privilege escalation vulnerabilities to achieve full system compromise. CTIX analysts urge any affected readers to make sure they follow the CISA guidelines by the deadline to prevent future exploitation.