Microsoft Blasts Uncoordinated Zero-Day Disclosures After Six Flaws Published Without Patches
Microsoft warned that six zero-day vulnerabilities—including RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma—were publicly disclosed without coordinated vulnerability disclosure, exposing users to exploitation before patches were ready.
Microsoft has issued a strong warning after multiple zero-day vulnerabilities were publicly disclosed without prior coordination, raising concerns about increased risk to users and enterprise environments. The company stated that recent disclosures exposed critical security flaws before patches were available, giving threat actors a potential advantage in exploiting unprotected systems.
According to Microsoft, several vulnerabilities, including RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), BlueHammer (CVE-2026-33825), and YellowKey (CVE-2026-45585), as well as GreenPlasma and MiniPlasma, were publicly disclosed without following Coordinated Vulnerability Disclosure (CVD) practices. This industry-standard process requires researchers to privately share findings with vendors, allowing time for investigation, mitigation, and patch development before technical details are made public.
Microsoft emphasized that such coordination plays a critical role in reducing real-world exploitation. By receiving early reports, security teams can deploy fixes and protections across affected services before proof-of-concept (PoC) code becomes accessible to attackers. In contrast, uncoordinated disclosures expose systems to immediate threats, especially when detailed technical information or exploit code is released.
The company noted that its internal teams have been working continuously to assess the impact of these vulnerabilities and develop security updates. However, the lack of prior notification significantly complicates response efforts and increases the window of exposure for customers. Microsoft strongly criticized the practice of releasing zero-day details without vendor coordination, calling it "never justifiable" due to the potential harm to the broader digital ecosystem. The company highlighted that threat actors actively monitor public disclosures for new attack vectors, often weaponizing vulnerabilities before patches are available.
The Microsoft Security Response Center (MSRC) reiterated its long-standing collaboration with the global research community through its CVD program. Each year, Microsoft works with hundreds of researchers to recognize and financially reward responsible disclosures. This partnership is designed to balance transparency with security, ensuring vulnerabilities are addressed before they can be exploited at scale. In addition, Microsoft’s Digital Crimes Unit continues to track and take action against cybercriminal groups that leverage such vulnerabilities.
Despite the recent incidents, Microsoft maintained that it remains open to collaboration and encourages researchers to submit findings through its public vulnerability reporting portal. The company also acknowledged the importance of ongoing dialogue within the security community, including discussions at conferences and research forums, to improve disclosure practices and strengthen collective defenses. The warning highlights a growing tension in the cybersecurity ecosystem between rapid disclosure and responsible coordination, as organizations face increasing pressure to balance transparency with user protection.