A dangerous Windows vulnerability nicknamed BlueHammer (CVE-2026-33825) has been picked up by ransomware gangs, who are now actively using it to break into computers. The flaw lives inside Microsoft Defender — the built-in security software on all Windows PCs — and lets an attacker who already has a small foothold on your machine quietly gain full administrator control by stealing password data stored on your device. Microsoft fixed the issue in its April 2026 updates, but many systems worldwide have still not applied the patch.
Ransomware gangs love privilege-escalation flaws like this one because they turn a limited intrusion into a full system takeover — letting criminals encrypt all your files and demand payment to restore them. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-33825 to its actively exploited vulnerabilities list. Home users and small businesses should treat this update as urgent.
How to check if you’re affected
Affected versions include any Windows system that has not received the April 2026 Patch Tuesday security updates. The fix for CVE-2026-33825 shipped on April 14, 2026.
- Press Windows + I to open Settings.
- Go to Windows Update and click Check for updates.
- Install all pending updates — particularly any labeled “April 2026 Cumulative Update” or any update from that date onward.
- Restart your computer after updates complete.
If Windows Update shows your system is fully up to date with updates from April 2026 or later, you are protected.