BlueHammer Windows flaw grants SYSTEM access before patch

BlueHammer is a Windows local privilege escalation vulnerability that can allow a threat actor with some prior access to move to SYSTEM-level control on a device. The flaw gained attention after exploit code was publicly released before a patch was available, meaning defenders could not rely on a fix for immediate protection.

According to BleepingComputer, the publicly released exploit code could elevate a low-privileged user to NT AUTHORITYSYSTEM, underscoring the severity of the issue even though it does not provide initial remote access. The article notes that the exploit’s reliability varies across Windows environments, with some bugs in the code and inconsistent results on Windows Server in particular, but the core issue remains exploitable.

Security researcher Will Dormann also shared testing related to BlueHammer, illustrating the end result of successful privilege escalation. Published on 7 April 2026, the piece urges organisations to prioritise containment, reduced local privileges, and enhanced monitoring while a fix is awaited.