Microsoft Threatens Legal Action Over Exploit Disclosure

Three critical Windows zero-day vulnerabilities, publicly disclosed by a researcher, are actively exploited in live intrusions. This situation prompted Microsoft to threaten legal action against the individual responsible, Nightmare Eclipse. The company criticized Nightmare Eclipse for publicly disclosing bugs affecting Windows Defender and BitLocker without prior reporting, according to TechCrunch. Six zero-day exploits targeting Windows components were released by Nightmare Eclipse between early April and mid-May 2026, including a local privilege escalation exploit named BlueHammer on April 3rd, 2026.

This public disclosure by a security researcher, intended to force vendor action, instead led to active exploitation and a legal threat from Microsoft. This outcome risks undermining the very goal of improved security by creating a chilling effect on future disclosures.

The cybersecurity industry will likely see increased legal scrutiny around vulnerability disclosure practices, potentially leading to a more cautious, and possibly slower, public reporting environment for security researchers, while simultaneously highlighting the urgent need for rapid patching by users.

• Microsoft initiated legal action against the security researcher Nightmare Eclipse for publicly disclosing zero-day exploits affecting Windows components, according to The Verge.
• Nightmare Eclipse publicly disclosed bugs targeting Windows Defender and BitLocker without prior reporting to Microsoft, according to TechCrunch.
• Three specific vulnerabilities—BlueHammer, UnDefend, and RedSun—have been actively exploited in live intrusions, according to The Record from Recorded Future News.
• These actively exploited vulnerabilities were added to CISA's catalog of known exploited vulnerabilities, as reported by The Record from Recorded Future News.
• Some of the publicly disclosed vulnerabilities saw active exploitation after Nightmare Eclipse posted exploit code in April, with Microsoft releasing patches only a week prior to the article's publication, according to BankInfoSecurity.
• Microsoft's general manager for security response, Christopher Betz, stated that public disclosure of zero-day vulnerabilities is "never justifiable" when it leads to active exploitation, according to The Record from Recorded Future News.