Hackers have exploited three unpatched Windows security flaws, dubbed BlueHammer, UnDefend and RedSun, to break into at least one organization according to cybersecurity firm Huntress.

The vulnerabilities affect Microsoft-made antivirus Windows Defender, potentially allowing high-level or administrator access. BlueHammer is the only bug patched so far by Microsoft this week.

Chaotic Eclipse, a security researcher who published exploit code online earlier this month, released UnDefend and RedSun in quick succession. Their code was available on GitHub for all to use.

The incident highlights the tension between full disclosure—a practice where researchers share details with software makers before public release—and immediate cyberattacks exploiting these flaws.

John Hammond from Huntress said: “Scenarios like these cause us to race with our adversaries; defenders frantically try to protect against ill-intended actors who rapidly take advantage of these exploits.”