{"schema":"vulnpedia.poc/1","cve":"CVE-2026-33825","kev":{"since":"2026-04-22","ransomware":true},"epss":{"score":0.06749,"percentile":0.93919},"cvss":{"version":"3.1","score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"},"test_commands":[{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2026-33825/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}],"generated":"2026-10-26T06:59:15.268Z","has_public_poc":true,"poc_sources":[{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/bd9764a2ca3d","executable":false,"sourceId":"bd9764a2ca3d","verification":"catalogued","source":"vulncheck-kev","modified":"2026-04-16T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"bd9764a2ca3d","modified":"2026-04-16T00:00:00Z","url":"https://vulncheck.com/xdb/bd9764a2ca3d"}],"repositoryUrl":"https://github.com/Joe1sn/CVE-2026-33825"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/0fe7eeef01b9","executable":false,"sourceId":"0fe7eeef01b9","verification":"catalogued","source":"vulncheck-kev","modified":"2026-04-16T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0fe7eeef01b9","modified":"2026-04-16T00:00:00Z","url":"https://vulncheck.com/xdb/0fe7eeef01b9"}],"repositoryUrl":"https://github.com/mostwise/RedSun"}],"poc_candidates":[{"url":"https://github.com/Letlaka/redsun-bluehammer-undefend-detection-pack","source":"poc-in-github","sourceId":"CVE-2026-33825","description":"Microsoft Defender XDR KQL detections for RedSun, BlueHammer, UnDefend, and CVE-2026-33825-related Defender abuse behaviors.","modified":"2026-10-06T22:57:34Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/Letlaka/redsun-bluehammer-undefend-detection-pack"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-10-06T22:57:34Z","url":"https://github.com/Letlaka/redsun-bluehammer-undefend-detection-pack"}],"tags":[]},{"url":"https://github.com/Bilal3755/Detecting_blue_hammer_vuln","source":"poc-in-github","sourceId":"CVE-2026-33825","description":"Threat hunting query for bluehammer CVE windows CVE-2026-33825","modified":"2026-04-20T09:38:41Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/Bilal3755/Detecting_blue_hammer_vuln"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-04-20T09:38:41Z","url":"https://github.com/Bilal3755/Detecting_blue_hammer_vuln"}],"tags":[]},{"url":"https://github.com/kaleth4/CVE-2026-33825","source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-04-22T12:39:23Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/kaleth4/CVE-2026-33825"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-04-22T12:39:23Z","url":"https://github.com/kaleth4/CVE-2026-33825"}],"tags":[]},{"url":"https://github.com/Joe1sn/CVE-2026-33825","source":"poc-in-github","sourceId":"CVE-2026-33825","description":"RedSun PoC for self use","modified":"2026-10-13T19:10:28Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/Joe1sn/CVE-2026-33825"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-10-13T19:10:28Z","url":"https://github.com/Joe1sn/CVE-2026-33825"}],"tags":[]},{"url":"https://github.com/0xBlackash/CVE-2026-33825","source":"poc-in-github","sourceId":"CVE-2026-33825","description":"CVE-2026-33825","modified":"2026-10-13T19:10:39Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/0xBlackash/CVE-2026-33825"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-10-13T19:10:39Z","url":"https://github.com/0xBlackash/CVE-2026-33825"}],"tags":[]},{"url":"https://github.com/anasabugaddara-ux/defender-bluehammer-audit","source":"poc-in-github","sourceId":"CVE-2026-33825","description":"Defensive Metasploit post module for CVE-2026-33825 (BlueHammer): Defender version/posture detection + compromise-hunt. Detection only.","modified":"2026-10-19T16:15:02Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/anasabugaddara-ux/defender-bluehammer-audit"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-10-19T16:15:02Z","url":"https://github.com/anasabugaddara-ux/defender-bluehammer-audit"}],"tags":[]},{"url":"https://github.com/dntaskmehow/NEO-DEFENDER","source":"poc-in-github","sourceId":"CVE-2026-33825","description":"This framework has been **RE-WEAPONIZED** & exploits CVE-2026-33825, a local privilege escalation (LPE) vulnerability in Microsoft Defender caused by insufficient access control granularity. The exploit:","modified":"2026-10-21T00:07:19Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/dntaskmehow/NEO-DEFENDER"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-10-21T00:07:19Z","url":"https://github.com/dntaskmehow/NEO-DEFENDER"}],"tags":[]}],"detection_sources":[],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2026-33825%22&type=repositories","executable":false}]}