{"schema":"vulnpedia.research/1","cve":"CVE-2026-33825","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825","tags":["vendor-advisory","patch","Vendor Advisory"],"source":"mitre","sourceId":"microsoft","modified":"2026-10-15T15:53:00.964Z","origins":[{"source":"mitre","sourceId":"microsoft","modified":"2026-10-15T15:53:00.964Z","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825"},{"source":"nvd","sourceId":"CVE-2026-33825","modified":"2026-07-24T22:10:00.140","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825"}]},{"url":"https://www.huntress.com/blog/nightmare-eclipse-intrusion","tags":["third-party-advisory","Third Party Advisory","KEV report"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-04-23T12:41:44.667Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-04-23T12:41:44.667Z","url":"https://www.huntress.com/blog/nightmare-eclipse-intrusion"},{"source":"nvd","sourceId":"CVE-2026-33825","modified":"2026-07-24T22:10:00.140","url":"https://www.huntress.com/blog/nightmare-eclipse-intrusion"},{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","url":"https://www.huntress.com/blog/nightmare-eclipse-intrusion"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-04-23T12:41:44.667Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-04-23T12:41:44.667Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825"},{"source":"nvd","sourceId":"CVE-2026-33825","modified":"2026-07-24T22:10:00.140","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825"}]},{"source":"euvd","sourceId":"EUVD-2026-22643","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22643","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-22643","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22643"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://x.com/HuntressLabs/status/2044882050314817880","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","url":"https://x.com/HuntressLabs/status/2044882050314817880"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://www.guidepointsecurity.com/wp-content/uploads/2026/07/GRIT_Q2_2026_Ransomware__Cyber_Threat_Insights_Report.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","url":"https://www.guidepointsecurity.com/wp-content/uploads/2026/07/GRIT_Q2_2026_Ransomware__Cyber_Threat_Insights_Report.pdf"}]},{"url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape"}]},{"url":"https://securelist.com/malware-report-q2-2026-pc-iot-statistics/120960/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","url":"https://securelist.com/malware-report-q2-2026-pc-iot-statistics/120960/"}]},{"url":"https://vulncheck.com/xdb/bd9764a2ca3d","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"bd9764a2ca3d","modified":"2026-04-16T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"bd9764a2ca3d","modified":"2026-04-16T00:00:00Z","url":"https://vulncheck.com/xdb/bd9764a2ca3d"}]},{"url":"https://github.com/Joe1sn/CVE-2026-33825","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"bd9764a2ca3d","modified":"2026-04-16T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"bd9764a2ca3d","modified":"2026-04-16T00:00:00Z","url":"https://github.com/Joe1sn/CVE-2026-33825"}]},{"url":"https://vulncheck.com/xdb/0fe7eeef01b9","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"0fe7eeef01b9","modified":"2026-04-16T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0fe7eeef01b9","modified":"2026-04-16T00:00:00Z","url":"https://vulncheck.com/xdb/0fe7eeef01b9"}]},{"url":"https://github.com/mostwise/RedSun","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"0fe7eeef01b9","modified":"2026-04-16T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0fe7eeef01b9","modified":"2026-04-16T00:00:00Z","url":"https://github.com/mostwise/RedSun"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/Letlaka/redsun-bluehammer-undefend-detection-pack","source":"poc-in-github","sourceId":"CVE-2026-33825","description":"Microsoft Defender XDR KQL detections for RedSun, BlueHammer, UnDefend, and CVE-2026-33825-related Defender abuse behaviors.","modified":"2026-10-06T22:57:34Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/Letlaka/redsun-bluehammer-undefend-detection-pack"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-10-06T22:57:34Z","url":"https://github.com/Letlaka/redsun-bluehammer-undefend-detection-pack"}],"tags":[]},{"url":"https://github.com/Bilal3755/Detecting_blue_hammer_vuln","source":"poc-in-github","sourceId":"CVE-2026-33825","description":"Threat hunting query for bluehammer CVE windows CVE-2026-33825","modified":"2026-04-20T09:38:41Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/Bilal3755/Detecting_blue_hammer_vuln"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-04-20T09:38:41Z","url":"https://github.com/Bilal3755/Detecting_blue_hammer_vuln"}],"tags":[]},{"url":"https://github.com/kaleth4/CVE-2026-33825","source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-04-22T12:39:23Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/kaleth4/CVE-2026-33825"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-04-22T12:39:23Z","url":"https://github.com/kaleth4/CVE-2026-33825"}],"tags":[]},{"url":"https://github.com/Joe1sn/CVE-2026-33825","source":"poc-in-github","sourceId":"CVE-2026-33825","description":"RedSun PoC for self use","modified":"2026-10-13T19:10:28Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/Joe1sn/CVE-2026-33825"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-10-13T19:10:28Z","url":"https://github.com/Joe1sn/CVE-2026-33825"}],"tags":[]},{"url":"https://github.com/0xBlackash/CVE-2026-33825","source":"poc-in-github","sourceId":"CVE-2026-33825","description":"CVE-2026-33825","modified":"2026-10-13T19:10:39Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/0xBlackash/CVE-2026-33825"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-10-13T19:10:39Z","url":"https://github.com/0xBlackash/CVE-2026-33825"}],"tags":[]},{"url":"https://github.com/anasabugaddara-ux/defender-bluehammer-audit","source":"poc-in-github","sourceId":"CVE-2026-33825","description":"Defensive Metasploit post module for CVE-2026-33825 (BlueHammer): Defender version/posture detection + compromise-hunt. Detection only.","modified":"2026-10-19T16:15:02Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/anasabugaddara-ux/defender-bluehammer-audit"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-10-19T16:15:02Z","url":"https://github.com/anasabugaddara-ux/defender-bluehammer-audit"}],"tags":[]},{"url":"https://github.com/dntaskmehow/NEO-DEFENDER","source":"poc-in-github","sourceId":"CVE-2026-33825","description":"This framework has been **RE-WEAPONIZED** & exploits CVE-2026-33825, a local privilege escalation (LPE) vulnerability in Microsoft Defender caused by insufficient access control granularity. The exploit:","modified":"2026-10-21T00:07:19Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-33825","url":"https://github.com/dntaskmehow/NEO-DEFENDER"},{"source":"poc-in-github","sourceId":"CVE-2026-33825","modified":"2026-10-21T00:07:19Z","url":"https://github.com/dntaskmehow/NEO-DEFENDER"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"bd9764a2ca3d","url":"https://vulncheck.com/xdb/bd9764a2ca3d","cve":"CVE-2026-33825","dateAdded":"2026-05-02T06:52:02Z","modified":"2026-04-16T00:00:00Z","exploitType":"local","repositoryUrl":"https://github.com/Joe1sn/CVE-2026-33825","observations":[{"dateAdded":"2026-05-02T06:52:02Z","exploitType":"local"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"bd9764a2ca3d","modified":"2026-04-16T00:00:00Z","url":"https://vulncheck.com/xdb/bd9764a2ca3d"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"0fe7eeef01b9","url":"https://vulncheck.com/xdb/0fe7eeef01b9","cve":"CVE-2026-33825","dateAdded":"2026-05-04T20:46:26Z","modified":"2026-04-16T00:00:00Z","exploitType":"local","repositoryUrl":"https://github.com/mostwise/RedSun","observations":[{"dateAdded":"2026-05-04T20:46:26Z","exploitType":"local"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"0fe7eeef01b9","modified":"2026-04-16T00:00:00Z","url":"https://vulncheck.com/xdb/0fe7eeef01b9"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-04-16T00:00:00Z","modified":"2026-04-16T00:00:00Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known","reportedByVulncheckCanaries":false,"vendorProject":"Microsoft","product":"Defender","dueDate":"2026-05-06T00:00:00Z","cisaDateAdded":"2026-04-22T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","modified":"2026-04-16T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","catalog":"VulnCheck KEV","kind":"report","url":"https://x.com/HuntressLabs/status/2044882050314817880","dateAdded":"2026-04-16T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","url":"https://x.com/HuntressLabs/status/2044882050314817880"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","catalog":"VulnCheck KEV","kind":"report","url":"https://www.huntress.com/blog/nightmare-eclipse-intrusion","dateAdded":"2026-04-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","url":"https://www.huntress.com/blog/nightmare-eclipse-intrusion"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","dateAdded":"2026-04-22T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","catalog":"VulnCheck KEV","kind":"report","url":"https://www.guidepointsecurity.com/wp-content/uploads/2026/07/GRIT_Q2_2026_Ransomware__Cyber_Threat_Insights_Report.pdf","dateAdded":"2026-07-09T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","url":"https://www.guidepointsecurity.com/wp-content/uploads/2026/07/GRIT_Q2_2026_Ransomware__Cyber_Threat_Insights_Report.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","catalog":"VulnCheck KEV","kind":"report","url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape","dateAdded":"2026-07-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","catalog":"VulnCheck KEV","kind":"report","url":"https://securelist.com/malware-report-q2-2026-pc-iot-statistics/120960/","dateAdded":"2026-08-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-33825","url":"https://securelist.com/malware-report-q2-2026-pc-iot-statistics/120960/"}]}]}