--- title: "CISA: Windows BlueHammer flaw now exploited by ransomware gangs" url: https://daily.dev/posts/cisa-windows-bluehammer-flaw-now-exploited-by-ransomware-gangs-8msc5m9tl source_url: https://www.bleepingcomputer.com/news/security/cisa-windows-bluehammer-flaw-now-exploited-by-ransomware-gangs type: article source: "BleepingComputer" published: 2026-06-30T08:53:54.946Z updated: 2026-06-30T08:54:39.931Z tags: ["security", "windows", "ransomware"] reading_time: 3 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CISA: Windows BlueHammer flaw now exploited by ransomware gangs **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 1 upvotes · 0 comments ## Summary CISA has updated its Known Exploited Vulnerabilities catalog to flag CVE-2026-33825 (BlueHammer), a high-severity Microsoft Defender local privilege escalation flaw, as actively exploited by ransomware gangs. Originally leaked in April by a researcher known as 'Nightmare Eclipse' along with proof-of-concept code, the vulnerability allows attackers to access the Security Account Manager (SAM) database and escalate to SYSTEM privileges. Microsoft patched it in April 2026 Patch Tuesday, but exploitation as a zero-day was confirmed shortly after. CISA had previously ordered federal agencies to patch by May 7; the new update confirms ransomware actors are now leveraging the flaw. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [BlueHammer Microsoft Defender Flaw Exploited in Ransomware Attacks](https://daily.dev/posts/bluehammer-microsoft-defender-flaw-exploited-in-ransomware-attacks-epvsqsotd) · Security Boulevard · 0 upvotes · 0 comments - [CISA: Windows Task Host flaw now exploited by ransomware gangs](https://daily.dev/posts/cisa-windows-task-host-flaw-now-exploited-by-ransomware-gangs-wem3tecny) · BleepingComputer · 0 upvotes · 0 comments - [CISA orders feds to patch Windows flaw exploited as zero-day](https://daily.dev/posts/cisa-orders-feds-to-patch-windows-flaw-exploited-as-zero-day-gw4v2yydq) · BleepingComputer · 1 upvotes · 0 comments - [Ransomware scum, other crims exploit 4 old Microsoft bugs](https://daily.dev/posts/ransomware-scum-other-crims-exploit-4-old-microsoft-bugs-ez6lhkszs) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#windows](https://daily.dev/tags/windows), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/cisa-windows-bluehammer-flaw-now-exploited-by-ransomware-gangs-8msc5m9tl)