The software scanning your endpoints for ransomware just handed attackers the keys.

That’s the short version of BlueHammer, tracked as CVE-2026-33825, a flaw in Microsoft Defender that was exploited in the wild as a zero-day before any patch existed. Ransomware crews used the bug in the tool that was supposed to stop them. If your cybersecurity strategy treats endpoint protection as the thing that catches attacks rather than as a fat, privileged attack surface in its own right, this is your wake-up call.

Cybersecurity tools are still just software

Security agents run everywhere, with deep hooks into the kernel, file system, and process tree. They run as SYSTEM. They auto-update. They’re trusted by everything around them. That is exactly the profile an attacker wants to own.

Defender isn’t special here. It’s just the latest. Antivirus engines, EDR sensors, your firewall management plane, VPN concentrators, and backup agents all share the same dirty secret: they are large, complex codebases with enormous privilege and a standing invitation to parse hostile input. When one of them has a bug, the blast radius isn’t one app. It’s the whole machine.

And the trust runs deeper than code. Look at ToddyCat’s latest tooling, which steals OAuth authorization tokens to walk into corporate Gmail without ever touching a password. Same pattern, different layer. The attacker borrows something you already trust instead of breaking down the front door.

When the watchdog is the weakness, your detection assumptions invert. The process you’d never flag is the one running the payload.

Patch what you trust like it’s exposed

Most teams patch security tooling on the relaxed cadence they’d use for an internal app, because it feels safe. It isn’t. Treat your defensive stack with the same urgency you give an internet-facing box. Here’s where to start.

Immediate actions:

• Inventory every security agent on every host: AV/EDR, firewall and VPN clients, backup software, management consoles. You can’t patch what you haven’t counted.
• Confirm BlueHammer (CVE-2026-33825) is remediated across your fleet, and verify the engine and signature versions actually rolled out instead of trusting the dashboard’s green checkmark.
• Pull current threat-protection builds for every endpoint agent and push emergency updates the same way you’d handle a critical edge-device CVE.
• Hunt for abuse now, not after. Look for your security agent spawning shells, writing to unusual paths, or disabling its own logging. That behavior is your earliest signal.

Ongoing security hardening:

• Isolate management planes. Defender consoles, EDR servers, and firewall admin interfaces should never sit on the same flat network as user endpoints, and brute-force protection plus MFA belongs on every one of them.
• Ship logs off-host. If the compromised tool also controls its own telemetry, you’ve lost your evidence. Stream to a destination the endpoint can’t reach back into.
• Practice defense in depth so a single failed agent doesn’t end the game. Network segmentation, application allowlisting, and tamper-resistant backups all buy you time when the primary control falls.
• Rehearse incident response for the specific case where your security software is the foothold. Most playbooks assume the EDR is a trustworthy narrator. Write the version where it isn’t.

None of this requires a new product. It requires treating cyber security tooling as privileged code that fails like any other.

Stop grading risk by severity alone

BlueHammer is also a lesson in prioritization. A vulnerability’s CVSS score didn’t matter the moment ransomware operators started using it. Exploitation evidence did.

That’s the entire thrust of CISA’s new BOD 26-04, which pushes federal agencies, and by contract fl-down, a lot of private firms, away from counting patched vulnerabilities and toward proving they fixed the ones being actively exploited. The directive leans hard on the KEV catalog and a risk-based model that asks whether a flaw is exposed, automatable, and granting real control. A bug in your endpoint agent that yields SYSTEM and is already in ransomware kits checks every one of those boxes.

The takeaway for any team, federal or not, is blunt. “We patched 95% of criticals” is the wrong metric. “We remediated every known-exploited flaw in our security stack within the week” is the one that maps to actual risk.

Research backs this up: organizations can only remediate a small slice of their backlog each month, so what you choose to fix first is the whole game. Spend that capacity on the tools attackers are already turning against you.

The uncomfortable truth is that threat detection now includes detecting your own defenses going rogue. The software you bought to watch the perimeter is inside it, running as root, and occasionally shipping a zero-day. Patch it like you mean it, log it somewhere it can’t touch, and stop assuming the watchdog is on your side by default.

Sources

• BlueHammer Vulnerability Exploited in Ransomware Attacks
• How CISA BOD 26-04 redefines vulnerability management metrics for security leaders
• ToddyCat: your hidden email assistant. Part 2