April 13, 2026, 3:57 pm | Read time: 3 minutes
A newly discovered vulnerability in Windows 11 is currently drawing attention. The flaw, named “BlueHammer,” allows attackers to gain extensive rights on a computer. Particularly concerning is that there has been no official response from Microsoft on the issue so far. Out of frustration, a researcher has published the code.
The publication is by a security researcher who calls himself “Chaotic Eclipse.” According to his own statements, he had previously reported the vulnerability to the Microsoft Security Response Center (MSRC). However, he found the response too slow. The exchange with Microsoft also apparently did not go satisfactorily. In a blog post, he expresses himself clearly:
“I wasn’t bluffing, Microsoft, and I’ll do it again. Unlike the last times, I’m not explaining how it works–you geniuses can figure it out yourselves. A big thank you also to the management of the MSRC for making this possible.”
In protest, he then put a program online that demonstrates the vulnerability. He published this on GitHub. As announced, however, there are no detailed explanations or guidance on how to close the gap.
Attackers Can Gain Full Control
According to reports from “BleepingComputer,” other security experts rate the vulnerability as critical. It enables a so-called privilege escalation. This means an attacker can switch from a simple user account to the highest system rights, gaining access to the Security Account Manager database, where encrypted passwords of local users are stored.
With this information, a computer can be completely taken over. Attackers can install malware, read data, or prepare further attacks.
Dangerous Security Vulnerability in Outlook Mail! Microsoft Urgently Recommends an Update
WhatsApp Is Now Becoming a Malware Trap Here
Attack Does Not Yet Work Reliably
According to its author, the published code is still faulty. It is a so-called proof of concept, intended only to show that the attack is fundamentally possible. The researcher himself points out that bugs are still present.
Initial tests show that the attack does not currently work fully on Windows servers. There, rights can only be elevated to an extended administrator account, which must be additionally confirmed. Nevertheless, experts warn against underestimating the danger. Experienced developers could further develop and improve the code.
Also of interest: Microsoft’s Windows 11 causes problems in companies
How Users Can Protect Themselves
Until an official patch is released, users should be particularly cautious. It is currently unknown whether the vulnerability is already being actively exploited. However, its publication may have drawn more attention from cybercriminals. Until then, it is advisable to keep the system up to date, not open unknown email attachments, and be cautious with suspicious links.