Windows vulnerabilities published by a disgruntled Microsoft researcher are being exploited

Windows vulnerabilities published by a researcher dissatisfied with Microsoft are being exploited and only one of them has a security patch that corrects it.

In early April, the researcher known as ‘Chaotic Eclipse’ posted a proof of concept for a Windows vulnerability called BlueHammer, privilege escalation.

The reason for this decision was the Microsoft Security Response Center’s management of the security problem, which was not to the researcher’s liking.

Although BlueHammer was eventually picked up as CVE-2026-33825 and fixed with an April Windows update, Chaotic Eclipse published two other vulnerabilities, known as RedSun y UnDefendwhich lack correction.

All three are being exploited, as confirmed by the cybersecurity firm Huntress Labs, as shared on the social network X.

The Huntress SOC is observing the use of Nightmare-Eclipse’s BlueHammer, RedSun, and UnDefend exploitation techniques.

Investigation by: @wbmmfq, @Curity4201+ @_JohnHammond 🧵👇 pic.twitter.com/ZFRI2XAYIA

— Huntress (@HuntressLabs) April 16, 2026

RedSun, published on GitHub by Nightmare-Eclipse – the other pseudonym of the researcher angry with Microsoft -, allows overwrite system files and gain administrator privileges, and this is done by the antivirus itself, which overwrites the malicious file found in its original location.

For its part, UnDefend allows disable Windows Defender completely without requiring administrator privileges to run any malicious program without this protection intervening.