Microsoft patched three zero-days on Tuesday. Two of them hand attackers SYSTEM privileges on fully updated Windows systems. The third opens BitLocker-protected drives to anyone who can plug in a USB stick.
And within hours of those patches landing, another zero-day dropped. This one turned Microsoft Defender itself into an attack vector.
Here's what nobody's really talking about: this wasn't a security update. It was damage control.
The Three Zero-Days, Explained Plainly
Let's start with what Microsoft actually fixed. Three flaws. Three different paths to the same outcome—total control of your machine.
GreenPlasma (CVE-2026-45586) lives in CTFMON, the Collaborative Translation Framework. It's an ancient input method service that Microsoft has been meaning to kill for over a decade and never did. Exploit it, and you're running as SYSTEM. No admin rights needed. No UAC prompt. Just a local attacker and a fully patched Windows box.
MiniPlasma (CVE-2020-17103) is older and meaner. It's a race condition in the Cloud Files Mini Filter Driver—the thing that handles OneDrive sync operations. Trigger it while a malicious file is being processed, and boom. SYSTEM shell. The fact that this CVE number is from 2020 and we're still patching it in 2026 says everything about Microsoft's prioritization.
YellowKey (CVE-2026-45585) is the physical-access nightmare. It's a backdoor in WinRE, the Windows Recovery Environment. You know, that thing you boot into when your system won't start? Attackers with physical access can use it to bypass BitLocker on Windows 11 and Server 2022/2025. No encryption key required. Just a reboot, a USB drive, and a few minutes of patience.
All three were disclosed by a researcher going by "Nightmare Eclipse." All three were patched as part of the June 2026 Patch Tuesday update. And all three were disclosed in protest.
Why a Researcher Would Leak Zero-Days Publicly
This is the part that should keep security teams up at night.
Nightmare Eclipse didn't sell these exploits. Didn't ransom your files. Didn't hand them to a foreign government.
They leaked them because Microsoft ignored them.
For months, this researcher submitted reports through proper channels. Offered proof-of-concept code. Asked for CVEs. Asked for bounties. Got silence in return.
So they went public. And they didn't stop at three.
Before this month's patches, Nightmare Eclipse had already disclosed BlueHammer (CVE-2026-33825) and RedSun (no CVE assigned yet)—two local privilege escalation flaws that are now actively exploited in the wild. They also leaked UnDefend, a zero-day that lets standard users block Microsoft Defender's definition updates. Think about that for a second: a flaw that disables your antivirus with read-only access.
Microsoft's initial response? Threats of legal action. Then, after the blowback got too loud on social media, they backtracked and said they'd only pursue researchers who "break the law and engage in malicious activity causing real harm to our customers."
Translation: we'll ignore you until you embarrass us publicly, then we'll pretend we're the good guys.
RoguePlanet: The Defender Exploit That Came After
Here's where it gets worse.
Within hours of Microsoft releasing the June patches, Nightmare Eclipse dropped RoguePlanet. Another zero-day. This one targets Microsoft Defender itself.
According to BleepingComputer's reporting, RoguePlanet lets attackers spawn command prompts with SYSTEM privileges. The mechanism is different from the other three—it doesn't abuse a legacy component or a race condition in a file driver. It weaponizes Defender's own quarantine pipeline.
Microsoft didn't patch RoguePlanet alongside the other three. They didn't even have a CVE for it at time of writing. Which means any Windows system that applied Tuesday's patches is still vulnerable to this one.
That's not a security update. That's a partial fix for a problem that doesn't have a fix.
The Original RCE Vector and What Changed
RoguePlanet wasn't always limited to local privilege escalation. According to the researcher's original blog post, it began as a remote code execution vulnerability that exploited Microsoft Defender's handling of files hosted on remote SMB shares.
"In initial development, it was confirmed that this vulnerability was a remote code execution," Nightmare Eclipse wrote. "It required an attacker to coerce a victim to open a .vhd(x) in a remote SMB server, successful exploitation resulted in defender overwriting its own files and obviously the end outcome was an RCE."
Another attack scenario could have led to remote code execution simply by coercing a victim into opening an SMB share if symlink evaluation settings were enabled.
However, the researcher says Microsoft silently hardened Defender in mid-May by patching the "mpengine!SysIO*" API, which blocked junction attacks. "Rewriting RoguePlanet to make it functional again drained my soul and I couldn't complete the other scenarios and for now it remains unclear if RoguePlanet is limited to LPE or there is some sort of way to turn it into an RCE," the researcher wrote.
The exploit is a race condition, so its reliability varies. "I have managed to get a 100% success rate on some machines while it struggled to work on others," Nightmare Eclipse wrote in the self-hosted Git repository at projectnightcrawler.dev—created after GitHub and GitLab removed previous exploit repos.
Cybersecurity firm ThreatLocker independently verified the flaw against fully patched Windows 11 systems with KB5094126 installed. "Our initial analysis confirms that the RoguePlanet exploit is viable and performs as described. Organizations using application allowlisting can prevent the exploit from executing, providing an effective layer of protection against this attack," said Danny Jenkins, CEO of ThreatLocker.
What This Means for Your Environment
I know what you're thinking. You patched on Tuesday. You're covered.
You're not.
Here's what you actually need to do, starting now:
Disable WinRE if you don't use it. I know it feels risky. But if your recovery environment is just sitting there, collecting dust and attack surface, turn it off:
reagentc /disable
Block CTFMON at the group policy level. This service has been dead since Windows 7. It's not needed. It's just a vector that Microsoft forgot to remove:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
delete "ctfmon"
Hunt for RoguePlanet indicators. Watch your EDR logs for Defender processes spawning command shells:
DeviceProcessEvents
| where InitiatingProcessFileName =~ "MsMpEng.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe")
| where ProcessIntegrityLevel == "System"
If you see Defender launching a shell as SYSTEM, something's wrong. Defender doesn't do that. Not legitimately.
Enable application allowlisting. ThreatLocker's analysis confirms this is an effective mitigation against RoguePlanet. If your organization isn't already using application control, the timing couldn't be worse—but it's now table stakes.
Assume you're already compromised. I mean that literally. Every legacy service running on your endpoints, every race condition in file drivers, every trust boundary that doesn't actually trust anything—you can't patch all of it. You have to detect it.
The Bigger Problem Nobody Wants to Admit
This isn't really about Microsoft. It's about the entire model of how we handle software security.
We've built a system where vendors ship products with known flaws, patch them when they're exposed publicly, and then act surprised when someone exploits them. We treat security researchers who disclose responsibly like criminals until they go public, then we pretend we value transparency.
The Secure Future Initiative Microsoft announced recently rings hollow when you look at what's actually happening. These are things that should be table stakes—proper vulnerability handling, timely patches, respect for researchers who help you find flaws.
Instead, we got a PR campaign after the government called them out.
Nightmare Eclipse is right. They're not causing harm. They're forcing Microsoft to fix things they've known about for months and chose to ignore. Every other researcher watching this is feeling emboldened to speak up about their own experiences with MSRC.
The next zero-day isn't coming. It's already here. And Microsoft is still patching the symptoms while the disease gets worse.
Source: BleepingComputer — "Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges" by Lawrence Abrams, June 9, 2026
Microsoft Statement (Added 6/10/26)
After publishing this story, Microsoft told BleepingComputer that they are aware of the reported vulnerability and are investigating it.
"Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims. Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible," a Microsoft spokesperson told BleepingComputer.
"Importantly, we support coordinated vulnerability disclosure, an industry standard that protects customers and supports the research community by ensuring their findings are thoroughly investigated and addressed before being made public."
Related Reading
- RoguePlanet Zero-Day: Microsoft Defender Race Condition Grants SYSTEM Access — A deep dive into how the Defender exploit works, including its original RCE vector and ThreatLocker's independent verification.
- AI Accelerates Vulnerability Discovery: Record 206 CVEs on Patch Tuesday Signal New Normal — How AI is transforming the speed and scale of vulnerability discovery across the industry.