Microsoft Condemns Uncoordinated Disclosure of Windows Zero-Day Exploits

Microsoft said multiple Windows zero-day vulnerabilities were publicly disclosed without prior coordination, exposing customers before patches or mitigations were ready. The company identified the flaws as RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma, affecting components including Microsoft Defender and BitLocker, and said the releases undermined Coordinated Vulnerability Disclosure practices by giving attackers technical details and proof-of-concept material to weaponize. Microsoft said its security teams are assessing impact, developing updates, and continuing to accept reports through the Microsoft Security Response Center.

The disclosures were tied to researcher Chaotic Eclipse, also known as Nightmare-Eclipse, whose GitHub account was reportedly removed and whose GitLab account was later suspended after exploit tools were mirrored across platforms. Reports said BlueHammer (CVE-2026-33825) was patched in April and added to CISA’s Known Exploited Vulnerabilities catalog, while RedSun and UnDefend remained unpatched as of late May; Microsoft and outside researchers said BlueHammer, RedSun, and UnDefend were already being exploited in the wild, including in intrusions that began with compromised FortiGate VPN credentials and escalated through Defender flaws. The researcher has accused Microsoft of mishandling earlier communications and threatened another public release, deepening the dispute over vendor coordination and platform enforcement.