Two Zero-Days in One Week: BlueHammer Exposes Every Windows PC, Fortinet CVE-2026-35616 Hits Governments

The first week of April 2026 delivered two simultaneous nightmares for defenders. On April 3, security researcher "Chaotic Eclipse" published the BlueHammer exploit code on GitHub — a Windows zero-day enabling privilege escalation to SYSTEM — after Microsoft refused to treat it with adequate priority. Two days later, Fortinet released an emergency patch for CVE-2026-35616, a critical flaw (9.1/10) in FortiClient EMS already actively exploited against government entities worldwide.

BlueHammer: When a Researcher Loses Patience

BlueHammer is a Windows privilege escalation vulnerability combining two distinct flaws: a TOCTOU (Time-of-Check to Time-of-Use) bug and a path confusion issue. Together, they allow a local attacker to access the Security Account Manager (SAM) — the database containing password hashes for all local accounts — and obtain SYSTEM privileges. Will Dormann confirmed the exploit works on Windows Client (SYSTEM escalation) and partially on Windows Server (elevated administrator).

CVE-2026-35616: FortiClient EMS Under Global Attack

FortiClient EMS is the centralized platform organizations use to manage Fortinet endpoint security, widely deployed across government agencies, military institutions, and critical infrastructure operators worldwide. CVE-2026-35616 (9.1/10) allows an attacker to compromise the EMS server and potentially control all managed endpoints. Defused observed first exploitation attempts on honeypots from March 31, with significant acceleration during the Easter weekend.

Both CISA and Singapore's CSA issued urgent advisories. CISA added the CVE to its known exploited vulnerabilities catalog and ordered federal agencies to apply the hotfix by Thursday. This is the second critical FortiClient EMS vulnerability in three weeks.

FortiClient EMS is used widely across many governments around the world. The exposure could be extensive.

— Defused researchers, April 2026

The Pattern: Weekend and Holiday Attacks

The exploitation acceleration during Easter weekend is not coincidental. Attackers deliberately choose windows when security teams are reduced. NotPetya launched before a Ukrainian holiday. Kaseya was hit on the American July 4th weekend. Colonial Pipeline was struck on Friday evening. The pattern is documented and predictable, yet many organizations continue reducing security coverage during holidays.

The Convergence: Two Zero-Days + Medusa + TrueChaos

BlueHammer and CVE-2026-35616 don't exist in a vacuum. In the same week, Medusa ransomware exploits pre-disclosure zero-days to strike in 24 hours, the EU Commission was compromised via supply-chain, and Operation TrueChaos demonstrated how a single compromised server can infect dozens of government entities. An attacker can use CVE-2026-35616 for initial access via FortiClient EMS, BlueHammer for SYSTEM escalation, and Medusa for final ransomware — all within 24 hours.

Operational Recommendations

1. 1.FortiClient EMS: apply the CVE-2026-35616 hotfix immediately. CISA deadline: Thursday. Check all internet-facing Fortinet products for compromise indicators.
2. 2.BlueHammer mitigation: without a Microsoft patch, enforce least privilege. Limit local system access. Monitor SAM database access for anomalies.
3. 3.24/7 security coverage: weekend and holiday attacks are the dominant pattern. Ensure continuous SOC coverage or MDR services during high-risk periods.
4. 4.Disable device code flow: in Microsoft Entra conditional access policies, disable Device Authorization Grant where unnecessary.
5. 5.Defense-in-depth: no single defense suffices. Combine aggressive patch management, network segmentation, behavioral monitoring, and critical communications encryption.
6. 6.Incident response readiness: with 24-hour attack chains, the response plan must be tested and current. Response speed is the decisive variable.

Conclusion

Two zero-days in one week — one leaked by a frustrated researcher, the other actively exploited against governments — represent the new normal. The speed at which vulnerabilities move from discovery to mass exploitation has compressed from months to days, sometimes hours. Defense based on patching alone is no longer sufficient when attackers strike before patches exist. A resilience strategy that assumes compromise and protects what matters most — data, communications, operational continuity — is essential.