Microsoft criticises researcher after string of zero-day flaws published online

A breakdown in relations with Microsoft led to the public releases, the researcher argues

Microsoft has rebuked a security researcher who published details of multiple unpatched software vulnerabilities without first informing the company.

Microsoft described the disclosures as "irresponsible" and warned they have exposed customers to significant risk.

The researcher, known online as Nightmare Eclipse, recently released proof-of-concept exploit code for six separate vulnerabilities affecting Microsoft security products.

Microsoft said its security teams had been forced to work "around the clock" after the flaws were made public, leaving engineers scrambling to assess the impact and develop protections.

"In response to the unnecessary risk created by these disclosures, our security teams have been working around the clock to understand the impact, protect our customers, and develop security updates," the company said.

Coordinated Vulnerability Disclosure

The dispute centres on the long-established practice of Coordinated Vulnerability Disclosure (CVD), under which security researchers privately report flaws to vendors before publicly revealing details.

The process is intended to give companies time to issue fixes before attackers can exploit weaknesses.

However, Nightmare Eclipse claims a breakdown in relations with Microsoft led to the public releases.

In an online post, the researcher accused the company of refusing to engage, deleting an account previously used to report bugs and failing to compensate them for past discoveries.

"When I actively asked you to communicate with me, you refused, humiliated me and made sure to insult me in front of people," Nightmare Eclipse wrote.

"You defame me in public with your CVE-2026-45585 advisory even though you literally deleted the Microsoft account I used to report bugs to you with and I got zero pennies from doing so and I still happily did like an idiot."

The posts also contained a warning directed at Microsoft, urging followers to "mark" 14th July, a date the researcher suggested could bring further disclosures.

Vulnerabilities exploited

Several of the vulnerabilities have already been exploited after working code was published online.

Four of the vulnerabilities have so far received official Common Vulnerabilities and Exposures (CVE) designations. These include BlueHammer (CVE-2026-33825) and RedSun (CVE-2026-41091), both elevation-of-privilege flaws affecting Windows Defender; UnDefend (CVE-2026-45498), a denial-of-service vulnerability in Windows Defender; and YellowKey (CVE-2026-45585), a security feature bypass flaw affecting Windows BitLocker.

The remaining two bugs have yet to be assigned CVE identifiers.

GreenPlasma is an elevation-of-privilege flaw affecting Windows BitLocker, while MiniPlasma targets the Windows Cloud Filter driver by bypassing protections introduced to address CVE-2020-17103, a previously patched privilege-escalation vulnerability.

The researcher's accounts on code-hosting platforms GitHub and GitLab have since been suspended, according to reports.

Microsoft's handling of the situation criticised

Systems engineer Muhammad Qasim Shahzad wrote on LinkedIn that the disclosures had caused "more enterprise-level damage in six weeks than most advanced threat groups cause in a year".

Others, while critical of the releases themselves, have questioned Microsoft's handling of the situation.

Dustin Childs, a veteran vulnerability researcher and former Microsoft security employee, said coordinated disclosure is a "two-way street" and suggested more information was needed about the interactions between the company and the researcher.

Security researcher Kevin Beaumont described the ongoing dispute as a "dumpster fire" and noted that Microsoft had previously employed hackers who publicly disclosed vulnerabilities.

Despite those criticisms, neither Childs nor Beaumont supported the publication of unpatched flaws.

Microsoft says it remains committed to working with independent researchers and stressed that its public vulnerability reporting programme remains open to all contributors.

"We always have and will continue to welcome vulnerability submissions from anyone through our public researcher portal, regardless of past interactions or reputation," the company said.