OTX Threat: The Science of Exploitability: Decoding BlueHammer

BlueHammer (CVE-2026-33825) is an eight-stage local privilege-escalation chain targeting Windows Defender Antimalware Platform before version 4.18.26030.3011. It requires initial code execution as a standard user and chains CloudFilter callbacks, batch oplocks, object-manager symlinks, Defender's update RPC, offline SAM parsing, and SAMR operations to achieve NT AUTHORITY\SYSTEM access. The exploi CVEs: CVE-2026-33825