Microsoft Zero-Day Wave: Six Disclosures, Researcher Conflicts, and Enterprise Exposure

High-impact zero-days in Microsoft 365 Copilot and Windows, paired with researcher clashes involving Nightmare-Eclipse, exposed key challenges in enterprise vulnerability response.

Microsoft’s security ecosystem faced one of its most intense periods of scrutiny in recent years. A sustained wave of zero-day disclosures targeting core platforms, including Microsoft 365 Copilot and Windows, revealed persistent gaps in how widely deployed enterprise technologies handle rapidly evolving threats. What stood out was not only the volume and sophistication of the vulnerabilities but also the speed at which some were weaponized, alongside growing tensions between the vendor and independent researchers. These developments underscore a deeper challenge: even the most mature technology providers are struggling to keep pace with the velocity and creativity of modern vulnerability research in an AI-augmented threat landscape.

This edition examines the patterns, implications, and hard lessons emerging from these high-stakes disclosures for enterprise security leaders.

In May 2026, Microsoft addressed three critical information disclosure vulnerabilities in Microsoft 365 Copilot and Copilot Chat in Edge. The flaws: CVE-2026-26129, CVE-2026-26164, and CVE-2026-33111, involved improper neutralization of special elements in output (CWE-74 and CWE-77), enabling potential unauthorized access to sensitive enterprise data through Copilot’s extensive integration with corporate systems and data sources.

All three vulnerabilities were rated critical in severity, carried high confidentiality impact, and featured network-based attack vectors with no required privileges or user interaction. CVE-2026-26129 affected Business Chat functionality, while the others impacted core Copilot and Edge-embedded Chat experiences. Because these were cloud-side issues, Microsoft deployed fixes at the service layer with no customer action required.

Click on the post for our detailed technical breakdown.

Cytex Unified Platform Response

The Cytex platform addresses the governance and compensating control layer required for such AI systems through a tightly integrated set of capabilities:

• Dedicated Copilot Assessment Module: Continuous, agentless evaluation of M365 tenant configurations, data access permissions, identity governance, DLP policies, and Copilot-specific settings, delivering prioritized findings and remediation guidance.

• AICenturion Runtime Guardrails: Real-time input and output controls including PII/PHI redaction, prompt injection detection, sensitive data egress blocking, and topic restrictions, operating with minimal latency.

• Granular Activity Auditing: Comprehensive logging of every AI interaction, including prompts, responses, guardrail actions, and metadata for forensic and compliance purposes.

• Ontology Mapping and Continuous Compliance: Automatic correlation of AI events to controls across frameworks such as NIST 800-53, ISO 42001, SOC 2, HIPAA, and CMMC, with real-time posture tracking and automated evidence generation.

• Data Security Posture Management (DSPM): Discovery and classification of sensitive data to enforce least-privilege access for AI tools upstream.

By maintaining these controls within a unified data layer, Cytex enables organizations to enforce consistent governance over AI assistants, ensuring that vendor-side fixes are complemented by robust, verifiable customer-side controls.

In May 2026, independent security researcher Nightmare-Eclipse (also known as Chaotic Eclipse) released a series of six Windows zero-day and high-impact vulnerabilities, timed in waves following Patch Tuesday. The disclosures were accompanied by public accusations that Microsoft had mistreated the researcher and revoked their official bug-reporting access, leading to heightened tensions and threats of further releases.

Key Vulnerabilities Released:

• YellowKey (CVE-2026-45585): A security feature bypass affecting BitLocker encryption. The exploit leverages trusted Windows components in the Windows Recovery Environment to bypass encryption with physical access, without requiring traditional kernel exploits.

• GreenPlasma: A privilege escalation flaw that enables an unprivileged user to achieve SYSTEM-level access by abusing the ctfmon.exe process through memory manipulation and registry techniques.

• MiniPlasma: A privilege escalation targeting the Windows Cloud Files Mini Filter Driver (cldflt.sys). The researcher demonstrated that a five-year-old vulnerability (originally reported by Google Project Zero) remained exploitable on fully patched systems.

• BlueHammer (CVE-2026-33825) and RedSun (CVE-2026-41091): Two Windows Defender local privilege escalation flaws that saw active exploitation in the wild during May.

• UnDefend (CVE-2026-45498): A denial-of-service vulnerability in Microsoft Defender that interferes with security update mechanisms.

Cytex Insight: Enterprises can no longer rely solely on vendor patching timelines; unified visibility, continuous vulnerability assessment, and automated compensating controls are now essential for maintaining defensible posture.

The researcher publicly warned Microsoft of additional disclosures and indicated willingness to involve other vendors, escalating the conflict beyond technical disclosures. Microsoft responded with mitigation guidance for several flaws while working on patches.

These events highlight the increasing speed and public nature of zero-day research, as well as the complex dynamics between large vendors and independent researchers. For enterprises, the campaign reinforced the need for defense-in-depth, rapid mitigation deployment, and continuous monitoring of Windows endpoints, especially for devices with physical access risks or running critical workloads.

Microsoft disclosed a critical vulnerability in SharePoint Server that allows authenticated attackers with minimal permissions to achieve remote code execution. Tracked as CVE-2026-45659 with a CVSS score of 8.8, the flaw originates from deserialization of untrusted data within the platform.

The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. An attacker requires only Site Member permissions, a relatively low privilege level, to exploit the issue over the network. No administrator rights or special conditions are needed, making it accessible to any authenticated user with basic site access.

This disclosure continues a pattern of high-severity vulnerabilities in Microsoft collaboration and productivity platforms. SharePoint has historically been a frequent target for attackers due to its widespread deployment in enterprise environments and its role as a repository for sensitive corporate data. Microsoft has released security updates for all supported versions.

Click on the post for detailed technical breakdown.

Cytex Earns Multiple Gartner® Recognitions

Cytex has been recognized for DevOps Continuous Compliance Automation in:

• Gartner®¹ Hype Cycle™ for Secure Software Engineering, 2026

• Gartner® Hype Cycle™ for Site Reliability Engineering, 2026

• Gartner® Market Guide for DevOps Continuous Compliance Automation Tools

These recognitions highlight the growing industry validation of Cytex’s unified platform approach to continuous compliance, AI governance, and automated remediation.

Cytex Awarded U.S. Department of War Contract for Next-Gen Defense

Cytex has been selected through a competitive process as a contractor for the U.S. Department of the Army’s NEXT-GEN COMMERCIAL OPERATIONS IN DEFENDED ENCLAVES (NCODE) project.

The award enables Cytex to support the Defense Industrial Base with its AI-powered unified platform for advanced threat visibility, automated remediation, and continuous compliance. This contract reinforces the strategic importance of unified security platforms for national security and defense modernization efforts. We’re deeply grateful for the opportunity to contribute to America’s technological edge in defense.

Cytex unifies cybersecurity, AI governance, and compliance into a single AI-powered command center, securing every decision from model to agent. Interested?

Find out more at https://cytex.io

1. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.