Three Microsoft Windows Defender zero-day vulnerabilities disclosed by a security researcher operating under the alias “Nightmare Eclipse” are now under active exploitation, with CISA adding all three to its Known Exploited Vulnerabilities (KEV) catalog. The flaws — BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), and UnDefend (CVE-2026-45498) — target Microsoft Defender’s privilege escalation and defense evasion mechanisms, and have been linked to intrusion activity traced to Russian-geolocated infrastructure.
BlueHammer exploits a TOCTOU race condition for local privilege escalation and was patched in April 2026. RedSun targets Defender’s cloud file detection using opportunistic locks and directory junction swaps. UnDefend temporarily disables Defender protection by racing to lock its signature files. Microsoft issued emergency patches for RedSun and UnDefend on May 21, though security researchers reported RedSun remained incompletely patched as of early June. Three additional vulnerabilities — YellowKey (CVE-2026-45585), GreenPlasma, and MiniPlasma — were also part of the disclosure series.
The situation has become a flashpoint in the cybersecurity community. Nightmare Eclipse publicly disclosed the vulnerabilities without coordinating with Microsoft, claiming the company ignored responsible disclosure attempts. Microsoft responded with legal threats and disabled the researcher’s accounts on GitHub and GitLab. The researcher has warned that further significant disclosures are planned for July 14, 2026.
Source
Rescana · The Hacker News · DoublePulsar · Huntress
Commentary
This is one of the most consequential vulnerability disclosure disputes in years. Whether you think Nightmare Eclipse is reckless or justified depends largely on whether you believe Microsoft’s vulnerability response pipeline is functioning — and the evidence isn’t flattering. When a researcher claims they tried responsible disclosure and got ignored, and then the flaws end up being exploited by Russian-linked actors, it’s hard to argue the system worked.
Microsoft’s decision to respond with legal threats and platform bans, rather than acknowledgment and faster patching, has drawn sharp criticism from across the security community. The incomplete RedSun patch weeks after emergency disclosure is particularly damning. With the researcher promising another round of disclosures in July, Microsoft has about six weeks to either fix the relationship or prepare for more public embarrassment. For enterprise defenders, the immediate concern is simpler: check your Defender versions and patch now, because threat actors aren’t waiting for Microsoft’s lawyers to finish drafting cease-and-desist letters.