The local privilege escalation vulnerability CVE-2026-33825 affecting Microsoft Windows has become the starting point of a public conflict between a security researcher known as Nightmare Eclipse and the Microsoft Security Response Center team. Successful exploitation, according to available information, allows access to the Security Account Manager (SAM) database with hashes of local account passwords and elevation of privileges to SYSTEM level. Microsoft addressed the issue in the April 2026 Patch Tuesday release; however, this was followed by a series of additional vulnerability disclosures that the researcher positions as a protest against MSRC practices.
Technical details of CVE-2026-33825
The BlueHammer vulnerability (CVE-2026-33825) belongs to the class of local privilege escalation issues in Windows. According to third‑party analysis, the exploit combines two methods: TOCTOU (time-of-check to time-of-use) — a race condition between checking and using a resource — and path confusion, manipulation of filesystem paths. The combination of these techniques enables an attacker to gain access to the SAM database and escalate privileges to SYSTEM.
It should be noted that at the time of analysis, CVE-2026-33825 is not listed in the CISA Known Exploited Vulnerabilities catalog. A CVSS score is not provided in the available sources. The status of active exploitation in the wild is not confirmed based on primary sources, although some publications mention cases where the exploit was used — these reports require additional verification.
Reportedly, on compromised devices, manual execution of reconnaissance commands was observed before launching the exploits:
whoami /priv— check current privilegescmdkey /list— view stored credentialsnet group— enumerate domain groups
This indicates a post-exploitation scenario: the vulnerability was used to escalate privileges after an initial foothold in the system had already been obtained.
Context of the conflict and series of disclosures
The researcher Nightmare Eclipse (also referenced as Chaotic Eclipse), according to his own statements, published the exploit as a protest against MSRC practices. He claims that his vulnerability reports were ignored, and that interaction with the Microsoft team was accompanied by pressure. These assertions originate from a single source and are not corroborated by independent primary materials — such as official Microsoft statements or MSRC documentation.
Microsoft, in turn, reportedly accused the researcher of refusing coordinated vulnerability disclosure and stressed that publishing exploits before patches are released puts end users at risk. An original Microsoft statement on this matter is likewise not present in the available materials.
After BlueHammer was fixed, the researcher, according to the source, disclosed additional vulnerabilities in Microsoft Defender under the names RedSun and UnDefend, and after the May Patch Tuesday release, issues dubbed YellowKey and GreenPlasma. The latest episode is linked to the RoguePlanet vulnerability in Defender, where the researcher claimed that the protective changes in the patch created a new dangerous scenario. None of these vulnerabilities is confirmed by primary sources — vendor advisories or NVD records — in the materials currently available.
Particular attention is drawn to the accusation that Microsoft “silently” fixed RedSun — without assigning a CVE, without public notification, and without acknowledging that it had been exploited. If accurate, such a practice would undermine the transparency of vulnerability management processes and complicate patch prioritization for administrators.
Impact assessment
The CVE-2026-33825 vulnerability poses a risk to all Microsoft Windows systems that have not installed the April 2026 updates. Local privilege escalation to SYSTEM is one of the most critical post-exploitation scenarios: it enables full control over the machine, access to password hashes, and the potential for lateral movement within the network.
The broader context — the series of alleged disclosures — introduces additional uncertainty. Organizations using Microsoft Defender as their primary endpoint protection solution should account for the potential risk associated with the mentioned but as yet unverified vulnerabilities in this product.
Recommendations
- Immediately install the April and May 2026 Windows updates if this has not yet been done. CVE-2026-33825 was fixed in the April Patch Tuesday.
- Review logs for signs of reconnaissance: execution of
whoami /priv,cmdkey /list,net groupby atypical accounts or at unusual times may indicate post-exploitation activity. - Restrict local privileges according to the principle of least privilege. LPE-class vulnerabilities lose much of their value if an attacker cannot obtain initial access to the system with a standard user account.
- Monitor access to the SAM database — anomalous access to the SAM, SYSTEM, and SECURITY files in the
%SystemRoot%\system32\configdirectory should trigger an alert. - Track Microsoft updates for the affected products (Windows, Defender, BitLocker) in upcoming Patch Tuesday cycles — given the reported series of disclosures, the likelihood of additional fixes is high.
The priority for deploying the patch for CVE-2026-33825 is high, especially for systems in a domain environment, where compromise of SAM hashes can lead to cascading spread of an attack. Organizations that rely on Microsoft Defender should consider adding an extra layer of endpoint monitoring until the situation with the reported but unverified vulnerabilities in this product becomes clearer.
