Microsoft Warns Against Public Zero-Day Details Release Before

Microsoft has issued a strong warning following the public disclosure of multiple zero-day vulnerabilities without prior coordination, citing increased risk to users and enterprise environments.

The company stated that recent disclosures exposed critical security flaws before patches were available, giving threat actors a potential advantage in exploiting unprotected systems.

Microsoft Warns Zero-Day Disclosures

According to Microsoft, several vulnerabilities, including RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), BlueHammer (CVE-2026-33825), and YellowKey (CVE-2026-45585), as well as GreenPlasma and MiniPlasma, were publicly disclosed without following Coordinated Vulnerability Disclosure (CVD) practices.

This industry-standard process requires researchers to privately share findings with vendors, allowing time for investigation, mitigation, and patch development before technical details are made public.

Microsoft emphasized that such coordination plays a critical role in reducing real-world exploitation. By receiving early reports, security teams can deploy fixes and protections across affected services before proof-of-concept (PoC) code becomes accessible to attackers.

In contrast, uncoordinated disclosures expose systems to immediate threats, especially when detailed technical information or exploit code is released.

The company noted that its internal teams have been working continuously to assess the impact of these vulnerabilities and develop security updates.

To note, Microsoft’s GitLab and GitHub suspended Windows Exploit Researcher Nightmare-Eclipse after the GitHub Ban.

However, the lack of prior notification significantly complicates response efforts and increases the window of exposure for customers.

Microsoft strongly criticized the practice of releasing zero-day details without vendor coordination, calling it “never justifiable” due to the potential harm to the broader digital ecosystem.

The company highlighted that threat actors actively monitor public disclosures for new attack vectors, often weaponizing vulnerabilities before patches are available.

The Microsoft Security Response Center (MSRC) reiterated its long-standing collaboration with the global research community through its CVD program.

Each year, Microsoft works with hundreds of researchers to recognize and financially reward responsible disclosures.

This partnership is designed to balance transparency with security, ensuring vulnerabilities are addressed before they can be exploited at scale.

In addition, Microsoft’s Digital Crimes Unit continues to track and take action against cybercriminal groups that leverage such vulnerabilities.

The company confirmed it will coordinate with international law enforcement agencies when necessary to disrupt malicious activity linked to newly exposed flaws.

Despite the recent incidents, Microsoft maintained that it remains open to collaboration and encourages researchers to submit findings through its public vulnerability reporting portal.

The company also acknowledged the importance of ongoing dialogue within the security community, including discussions at conferences and research forums, to improve disclosure practices and strengthen collective defenses.

The warning highlights a growing tension in the cybersecurity ecosystem between rapid disclosure and responsible coordination, as organizations face increasing pressure to balance transparency with user protection.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.