CISA flags two Windows privilege-escalation flaws now used by ransomware gangs

CISA has marked two patched Windows privilege-escalation vulnerabilities as used in ransomware campaigns. On June 30, 2026, BleepingComputer reported that CISA updated its entry for CVE-2026-33825, nicknamed BlueHammer, a Microsoft Defender flaw that lets an attacker reach the SAM database and escalate to SYSTEM. A researcher leaked proof-of-concept code in early April, Microsoft fixed it on April 14, and CISA added it to the Known Exploited Vulnerabilities catalog on April 22. Separately, ThaiCERT reported on August 20 that CISA now says ransomware groups are exploiting CVE-2025-60710, a link-following flaw in the Host Process for Windows Tasks on Windows 11 and Windows Server 2025 that Microsoft fixed in November 2025.

Privilege-escalation bugs are not how attackers get in, but they are how a foothold from a phished user or a stolen password becomes control of a machine. Ransomware crews rely on exactly this step before disabling security tools and spreading. Both fixes have been available for months, so the risk sits with machines that missed updates.

Ask your IT provider for a patch compliance report showing the April 2026 updates and the November 2025 updates installed across all workstations and servers, including machines that are rarely online. Confirm Microsoft Defender platform updates are current as well, since Defender updates separately from Windows. Machines that cannot be patched should be isolated or retired.

Microsoft's own advisories had not been updated to show exploitation at the time of these reports, which is a reminder to use CISA's catalog, not only vendor severity ratings, to set patch priority.