In April 2026, Microsoft patched a privilege escalation flaw in Windows Defender that researchers nicknamed BlueHammer. By late June, CISA confirmed that ransomware crews were actively using it in live attacks, and it’s still showing up in incident reports today. If your business runs Windows and you’re not certain every machine has this patch, that’s worth fixing before you fix anything else this week.
What BlueHammer actually does
CVE-2026-33825 is a flaw in how Defender’s malware cleanup process handles file operations. An attacker who already has some foothold on a machine, even a low-privilege one like a compromised web app or a malicious file a user opened, can exploit a timing gap in Defender’s remediation engine to trick it into writing to a file the attacker chooses instead of the one it’s supposed to clean. Used correctly, that lets the attacker read the local Security Account Manager database and pull password hashes for every account on that machine, then escalate straight to SYSTEM, the highest privilege level Windows has.
In plain terms: it turns “I got onto one computer” into “I now control that computer completely and have credentials to try on your network.” That’s the step between a phishing click and a full ransomware deployment, and it’s exactly the step your security stack is supposed to stop.
Why this matters more for small businesses
Microsoft shipped a fix in April and CISA added BlueHammer to its Known Exploited Vulnerabilities catalog a couple weeks later, giving federal agencies 21 days to patch. Most small businesses in Southwest Florida don’t have that kind of forcing function. Patches get queued behind whatever’s urgent that week, and if you’re a clinic, law office, HOA management company, or contractor running a handful of Windows machines with no dedicated IT staff, “urgent” this time of year usually means hurricane prep, not a CVE number nobody’s heard of.
That gap is exactly what ransomware groups are counting on. Two of the more active crews this year, Qilin and Gentlemen, have each been linked to close to 300 victims in the second quarter alone, and BlueHammer has become one of the tools they lean on once they’re past the front door. It doesn’t get you in. It’s what lets an attacker who’s already in take over.
What to check this week
- Confirm every Windows workstation and server has the April 2026 Defender platform update installed, not just scheduled. A pending update isn’t a patched machine.
- If you have any devices that aren’t centrally managed, personal laptops used for work, an office machine nobody’s touched in a year, a back-office server running quietly in a closet, check those first. They’re the ones most likely to have been missed.
- Review who has local admin rights on your machines. BlueHammer is a privilege escalation bug, which matters less if attackers can’t do much with SYSTEM access because accounts, backups, and network segmentation already limit the blast radius.
- Make sure your backups are tested and stored somewhere a compromised admin account can’t reach or delete them. If ransomware does land, that’s what actually gets you back in business.
The hurricane season angle
This is also a good prompt to check something else: does your incident response plan assume your IT provider or in-house admin is reachable? Every summer, Southwest Florida businesses build generator and evacuation plans and leave the “what if we get hit by ransomware during a storm watch” question unanswered. A ransomware attack doesn’t wait for good weather, and a skeleton crew running the office during a hurricane threat is a worse time to be figuring out who has the recovery keys for the first time.
The bottom line
BlueHammer isn’t a reason to panic. It’s a reason to confirm something boring: that patches you think went out actually went out, everywhere, including the machines nobody thinks about. That single check closes off one of the more active paths ransomware groups are using against small businesses right now.
If you’re not sure whether your systems are patched, or you don’t have a clear answer for who handles a security incident if it happens during a storm, SWFIT can walk through both with you. Contact us to get a straight answer on where you stand.
Sources: SecurityWeek, “BlueHammer Vulnerability Exploited in Ransomware Attacks” and the CISA Known Exploited Vulnerabilities Catalog.
