Vulnerability

Philips names six products affected by Windows Defender BlueHammer, RedSun and UnDefend flaws

MedDevice Cyber Staff · Jun 4 · 3 min read · Via Philips security advisory

Philips published a notice on June 4, 2026 listing six products as affected by Microsoft Windows Defender vulnerabilities known as BlueHammer, RedSun and UnDefend (CVE-2026-33825, CVE-2026-41091 and CVE-2026-45498).

Microsoft has released patches for the three, which Philips describes as critical and actively exploited. The affected products are Advanced Visualization Workspace V15, IntelliSpace Perinatal, PIC iX 4.x, IntelliVue Guardian Software, IntelliVue XDS and UroNav 4.2.2 and 4.4.

The irony is old: the endpoint protection installed to harden these Windows hosts is the component under attack. Active exploitation moves this to the top of the service queue for any site running the listed systems.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Microsoft has released patches for CVE-2026-33825, CVE-2026-41091 and CVE-2026-45498, which Philips calls critical and actively exploited. Sites running the six listed Philips products should get the Philips-validated Defender update as a priority and tighten local and remote access to those hosts until it lands.

Prioritize the Defender update. Request the Philips-approved fix for every listed product; active exploitation justifies an expedited window.
Restrict interactive logons. Limit local and remote sessions on the affected Windows hosts to named service accounts.
Monitor endpoint protection health. Alert when Defender is disabled or its definitions stop updating on clinical hosts.
Keep the product list current. Map each listed product to its hosts so the next Windows advisory is a lookup, not a hunt.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

Off-the-shelf software Hospital network

Advanced Visualization Workspace

PID-23 Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which Philips products are affected by the BlueHammer, RedSun and UnDefend Windows Defender vulnerabilities?

Philips listed Advanced Visualization Workspace V15, IntelliSpace Perinatal, PIC iX 4.x, IntelliVue Guardian Software, IntelliVue XDS and UroNav 4.2.2 and 4.4 on June 4, 2026 as affected by CVE-2026-33825, CVE-2026-41091 and CVE-2026-45498.

Are the Windows Defender flaws CVE-2026-33825, CVE-2026-41091 and CVE-2026-45498 exploited?

Yes. Philips describes the three Windows Defender vulnerabilities as critical and actively exploited, and Microsoft has released patches for them.

Is there a fix for Windows Defender BlueHammer on Philips PIC iX?

Microsoft has patched the Windows Defender vulnerabilities; operators of PIC iX 4.x and the other listed Philips products should apply the update through Philips-authorized service.

← Back to Vulnerabilities