Home / Technology / Microsoft Battles Researcher Over Zero-Day Disclosures
Microsoft Battles Researcher Over Zero-Day Disclosures
10 Jun
Summary
- Microsoft fixed a high-severity zero-day vulnerability disclosed by a researcher.
- The researcher claimed Microsoft breached an agreement regarding vulnerability disclosures.
- A separate zero-day, potentially unpatched, was also noted by an independent analyst.
Microsoft recently issued a critical security update to address a zero-day vulnerability, identified as CVE-2026-45586. This vulnerability, a local privilege escalation flaw, was disclosed in May by a researcher operating under the pseudonym Nightmare Eclipse. The researcher alleged that Microsoft violated a prior agreement concerning vulnerability disclosures, leading to their decision to publicly release proof-of-concept code.
This disclosure drama escalated as Microsoft's June patch release included a fix for CVE-2026-45586. The vulnerability allowed attackers to gain SYSTEM rights, potentially enabling malware installation. Microsoft indicated that exploitation was possible with minimal complexity and without user interaction.
Separately, an independent analyst noted that a second vulnerability, MiniPlasma, also appeared to be patched. Nightmare Eclipse claimed this flaw was a regression of an issue supposedly fixed six years prior. Microsoft has not assigned a CVE to MiniPlasma, leaving its official status ambiguous, though its exploitability ceased after the recent patch.
Microsoft has not yet patched other vulnerabilities disclosed by Nightmare Eclipse, such as YellowKey, which can bypass Bitlocker encryption, or RedSun and BlueHammer, which also grant SYSTEM-level access. The company previously stated it would not pursue legal action against the researcher following public backlash over earlier threats.
