Microsoft Zero-Day Disclosure Rebuke Fails to Halt Exploit Drops

A vendor draws a line in public

Microsoft does not usually turn a disagreement with security researchers into a policy statement. On May 27, 2026, the Microsoft Security Response Center (MSRC) did exactly that. It published a post saying that several zero-day vulnerabilities had been released without the company being told first, and that those releases had put customers at "unnecessary risk."1113 The post, titled "A shared responsibility: Protecting customers through Coordinated Vulnerability Disclosure," named six flaws: RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma and MiniPlasma.1417 The company said publishing proof-of-concept code for unpatched bugs is "never justifiable" and "has real-world consequences."12

The statement was aimed at a campaign, not a single incident. A pseudonymous researcher calling themselves Nightmare Eclipse, also known as Chaotic Eclipse, started publishing Windows zero-days in April. Each one came with working exploit code on GitHub, a site Microsoft owns.1219 Five months on, the campaign has not stopped. It has also unfolded during the largest run of Microsoft patching on record. The case now shows two things: coordinated disclosure is under strain, and a vendor has limited power to restore it just by condemning the people who ignore it.

What Microsoft said, and what it walked back

The May post made the familiar argument for coordinated vulnerability disclosure (CVD). Under CVD, a researcher reports a flaw privately and waits through an embargo, usually 90 days, while the vendor builds a fix. In return the researcher gets credit and often a payment.11 Microsoft said its teams had been "working around the clock" on the six bugs. It added that its submission portal would stay open to researchers "regardless of past interactions or reputation," which read as a message to one person in particular.14

The sharpest part of the statement was about enforcement. Microsoft referred to its Digital Crimes Unit and said it would keep bringing cases against those who enable harmful activity, working with law enforcement around the world.1814 Coverage read this differently. Heise reported it plainly as Microsoft threatening lawsuits and police involvement.20 The CyberSignal said the language was general and did not name any target.14 Many people in the research community took it as a threat, and there was a backlash.30

On June 1, Microsoft posted a clarification on X saying it has "no intention to pursue action against individuals conducting or publishing their security research." It kept the option of working with law enforcement when someone causes real harm through malicious activity.14 The clarification also stopped using the term "responsible disclosure," which had appeared four times in the original post, and used "Coordinated Vulnerability Disclosure" instead. It admitted that "some interactions have fallen short" but did not respond to the researcher's specific complaints.14 The original post stayed online.

The fairest reading is that Microsoft overreached and then retreated without fully withdrawing. It defended a principle most of the industry supports, but it did so in language that made it look like the party with something to answer for.

The researcher's grievance

Nightmare Eclipse says the campaign is retaliation. On their blog, the researcher has claimed that Microsoft deleted their disclosure account, never paid them, defamed them in an advisory and threatened them. None of these claims had been verified when they were first reported.11 Later reporting described signed blog posts accusing MSRC of revoking portal access, dismissing reports and refusing bounties on confirmed findings.23 The researcher has said that "no amount of money" would turn them away from targeting Microsoft. They also warned of a release timed to the July 14 Patch Tuesday that would "make sure your bones are shattered that day."12

The researcher's repositories were taken down from GitHub and later from GitLab. They moved to self-hosted infrastructure and new aliases.2129 Hours after the June 2026 Patch Tuesday, an account called "MSNightmare" appeared on GitHub hosting RoguePlanet, a Defender privilege escalation exploit.23

The disclosures did real damage

The researcher's supporters describe them as a whistleblower. The record on exploitation is harder to dismiss. BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091) and UnDefend (CVE-2026-45498) were all added to CISA's Known Exploited Vulnerabilities catalog.23 At least three of the exploits were reportedly used in real intrusions by mid-April.29 Some researchers at larger firms, including Barracuda, have called Nightmare Eclipse a malicious actor because the releases fed into real attacks.21

Microsoft's fixes came in pieces. BlueHammer was patched on April 14. RedSun and UnDefend were patched out-of-band on May 21. YellowKey, GreenPlasma and MiniPlasma were fixed in the June 9 Patch Tuesday.23 MiniPlasma was tracked as CVE-2020-17103, a regression of a flaw Microsoft first fixed in 2020, which suggests the original fix was incomplete or had stopped working.21

The releases then came in a steady sequence:

• June: RoguePlanet, which Microsoft fixed in July through a Malware Protection Engine update under CVE-2026-50656.26
• July: LegacyHive, released on Patch Tuesday. Unusually, its proof-of-concept was deliberately stripped down to prevent immediate exploitation.27
• August: ShieldBreak, which researchers Kevin Beaumont and Will Dormann both reproduced.25
• September: ShieldCrash, which the researcher said bypasses the ShieldBreak fix.24

The researcher also turned to another vendor in early September, releasing FalconFlank against CrowdStrike's Falcon. CrowdStrike reportedly told customers to disable a related Office macro-removal policy while it investigated.24

Microsoft's public responses through this period have been brief. It repeatedly said it was "actively investigating the validity and potential applicability" of the claims and reaffirmed its support for coordinated disclosure.2730 The researcher called that "trying hard to paint [Eclipse] as some insane criminal." They also said they would start publishing bugs in other vendors' products, because Microsoft's restrictions stopped them from reporting those bugs properly.25

Where the reporting diverges

Reading the coverage side by side shows some real inconsistencies:

• CVE identifiers: Infosecurity Magazine's first list gave BlueHammer and UnDefend the same CVE number.11 Other outlets list BlueHammer as CVE-2026-33825 and UnDefend as CVE-2026-45498.1523
• Attribution: The CyberSignal noted that Microsoft never named a researcher in its post. It said linking four of the six flaws to Nightmare Eclipse came from Barracuda's analysis, not from Microsoft.14 Most other outlets attribute all six to the researcher.29
• Exploit quality: Some early Defender exploits relied on fragile race conditions and were hard to reproduce. GreenPlasma reportedly needed substantial extra work to become a reliable attack.30

These details matter. When defenders hear "ten zero-days," they should not assume ten equally dangerous attack tools.

The patch volume behind the dispute

The dispute is happening while Microsoft's patch releases are growing at an unprecedented rate. The company fixed 138 CVEs in May.16 The monthly count rose through the summer, from about 570 in July to nearly 1,000 in September.6 October's Patch Tuesday reached 1,413 CVEs by the counts of CrowdStrike and Rapid7.510 BleepingComputer's figure was 1,411, and SecurityOnline's was 1,414.18 CyberScoop noted that this single release was larger than any previous full year, beating the 1,261 CVEs fixed across 2020.2

October also included three zero-days. One was an actively exploited Windows Shell bypass of the Mark of the Web protection, CVE-2026-96951, which CISA ordered federal agencies to patch by October 16.37 Of the two publicly disclosed zero-days, the .NET Framework flaw was credited to Google Project Zero's James Forshaw.1 The October coverage does not tie either of them to Nightmare Eclipse. Microsoft introduced "risk cohorts" in the same release, grouping CVEs so overwhelmed teams can prioritize.7

This is the context that makes the argument over disclosure timelines more urgent. Dustin Childs of the Zero Day Initiative said AI "isn't creating these bugs out of thin air" but is shortening the gap between a flaw existing and someone finding it.2 Jacob Krell of Suzu Labs argued that a 90-day embargo was designed "for a slower world." He also said flaws that reach core components like Defender and BitLocker are a failure of vendor engineering.16 Another commentator suggested tiered deadlines: seven days for actively exploited critical bugs, and 90 days as the maximum for lower-severity ones.11 Katie Moussouris made a different point: dropping zero-days publicly is bad, but researchers withholding findings is worse, and threats from vendors are what push them toward silence.12

The verdict

Microsoft is right that releasing working exploits for unpatched Defender and BitLocker flaws harmed customers. The KEV listings show that.23 But the company's May statement did not deter anyone. Nightmare Eclipse has kept releasing exploits on Patch Tuesday cycles, and several fixes have reportedly been bypassed.2430 Coordinated disclosure only works if both sides trust it, and Check Point's Haifei Li has argued it "can't be just one-sided."12

For security teams the practical advice is the same as before. Treat a public proof-of-concept as an active incident. Use configuration workarounds and endpoint detection rules right away, rather than waiting for the next patch release.16 For Microsoft, the clearest way to show that coordination works is to fix flaws quickly and completely, and to repair its relationship with researchers. Warnings about legal action will not do that.