Microsoft has issued a clarifying statement, assuring the global cybersecurity community that it has no intention of pursuing legal action against security researchers conducting or publishing legitimate security research.
A significant walkback amid the firestorm sparked by its earlier confrontation with a researcher known as “Nightmare-Eclipse.”
The controversy began in April 2026 when an anonymous researcher using the handle Nightmare-Eclipse began publicly releasing zero-day vulnerabilities affecting core Windows components without first notifying Microsoft.
Over the following weeks, the researcher dropped details and working proof-of-concept (PoC) exploit code for six unpatched flaws: BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma, and MiniPlasma.
The vulnerabilities targeted two of Windows’ most trusted security pillars: Windows Defender (the built-in antivirus engine) and BitLocker (the disk-encryption utility).
At least three of the six BlueHammer, RedSun, and UnDefend were subsequently confirmed as being actively exploited in real-world attacks, a fact corroborated by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
Nightmare-Eclipse claimed the public disclosures were motivated by frustration with Microsoft’s handling of prior vulnerability reports alleging that the company had revoked their Microsoft Security Response Center (MSRC) portal access, deleted their reporting account, and failed to compensate them through the bug bounty program.
In late May 2026, Microsoft’s MSRC published a blog post condemning the researcher’s actions, calling the uncoordinated disclosures “never justifiable” and warning that its Digital Crimes Unit would “continue bringing cases against these actors and those that enable their criminal activity coordinating as needed with law enforcement around the world”.
The cybersecurity community erupted. Critics argued the language was dangerously broad, threatening not just bad actors but potentially any researcher who publishes vulnerability details outside Microsoft’s preferred channels.
Even Katie Moussouris, the architect of Microsoft’s own bug bounty program, publicly described the response as “over the top”. GitHub a Microsoft subsidiary and GitLab both suspended Nightmare-Eclipse’s accounts, further inflaming tensions.
Microsoft: No Lawsuits Against Researchers
Responding to the community backlash, Microsoft issued a new statement drawing a clear and important distinction.
The company confirmed it has no intention to pursue action against individuals conducting or publishing security research, reserving legal engagement only for cases where an individual “breaks the law and engages in malicious activity causing real harm to our customers”.
Microsoft acknowledged that “some interactions have fallen short” and pledged to learn from them, reaffirming its commitment to Coordinated Vulnerability Disclosure (CVD) as the foundation for protecting customers.
The company also noted that the volume of vulnerability reports continues to grow particularly with the rise of AI-enabled research and emphasized that many of its own staff have experience as researchers themselves.
The clarification is a meaningful step toward repairing a strained relationship. Microsoft’s MSRC processes a high volume of vulnerability reports each year and continues to welcome submissions from any researcher through its public portal, “regardless of past interactions or reputation”.
Security professionals are advised to continue following CVD best practices submitting findings via the MSRC Researcher Portal, including detailed proof-of-concept steps, and maintaining open communication throughout the disclosure timeline.
The incident serves as a stark reminder of how quickly the vendor-researcher relationship can fracture and the very real security consequences that follow when it does
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
