BlueHammer: Researcher Leaks Unpatched Windows Zero-Day After Microsoft Disclosure Dispute

A security researcher going by “Chaotic Eclipse” (also “Nightmare-Eclipse”) published a working privilege escalation exploit for Windows to GitHub on April 3, 2026, after Microsoft refused to engage with their vulnerability report without a video demonstration of the exploit. The bug has no patch. Microsoft has not publicly acknowledged CVE-2026-21513.

What the vulnerability does

BlueHammer is a local privilege escalation (LPE) flaw that chains a TOCTOU (Time-of-Check to Time-of-Use) race condition with a path confusion bug. The attack vector abuses four legitimate, documented Windows components simultaneously: Microsoft Defender’s update workflow, the Volume Shadow Copy Service, the Windows Cloud Files API, and opportunistic locks (oplocks).

The end result: a local attacker gains read access to the Security Account Manager (SAM) database, which stores NTLM password hashes for every account on the machine. With those hashes, privilege escalation to SYSTEM is straightforward using standard pass-the-hash techniques. Full machine compromise from a limited local user account.

Local access is required to trigger the flaw — attackers can reach that initial foothold through phishing, credential theft, or chaining with a separate remote code execution bug.

Security researcher Will Dormann independently confirmed the exploit functions as described and criticized Microsoft’s Security Response Center for what he called a shift toward “flowchart followers” over substantive security engagement.

Why the researcher published

Microsoft’s Security Response Center introduced a new requirement in 2026: vulnerability reports must include a demonstration video before MSRC will engage. The researcher objected and submitted anyway without video. Microsoft declined to engage.

“I’m just really wondering what was the math behind their decision,” the researcher wrote, “like you knew this was going to happen and you still did whatever you did?”

The published proof-of-concept was intentionally made buggy — less reliable, harder to weaponize at scale, and less effective on Windows Server platforms. The researcher made clear this was a deliberate concession, not a limitation of the underlying bug.

Microsoft responded with a statement reaffirming its “commitment to coordinated disclosure practices.” No patch timeline was announced.

What you should do now

There is no patch. That makes this situation unusual — defenders can’t simply upgrade to a fixed version.

Mitigation options while waiting for a patch:

• Audit local user access on sensitive machines. The attack requires local code execution; limit who can log in.
• Monitor for unusual access to \Windows\System32\config\SAM and shadow copy operations in your EDR.
• Watch for oplocks being held against Defender update paths — anomalous behavior EDR solutions may flag.
• Prioritize patching any remote code execution bugs that could provide the local access needed to trigger BlueHammer.

The intentionally buggy PoC is on GitHub and already being analyzed. Threat actors iterate fast. Assume a cleaner weaponized version is in development.

CVSS score has not been officially assigned by MSRC. Independent researchers put it in the 7.x–8.x range given the local access requirement, but the impact once triggered is SYSTEM-level.

This is the second high-profile disclosure dispute between an independent researcher and MSRC in 2026. The coordinated disclosure framework is under real strain.