Nightmare Eclipse: Six Defender Zero-Days, One Wide Open

Between April and July 2026, a researcher operating as Nightmare Eclipse (also Chaotic Eclipse) publicly released six Microsoft Defender and Windows zero-day exploits without prior vendor coordination. Three — BlueHammer, RedSun, and UnDefend — were confirmed exploited in the wild before patches shipped, with BlueHammer now actively used in ransomware campaigns per CISA. One flaw, RoguePlanet (CVE-2026-50656), remains unpatched on fully updated Windows 10 and 11 as of July 2, 2026, and the researcher has promised a fresh exploit dump on July 14 — Patch Tuesday. Security teams defending cloud-adjacent Windows estates have roughly two weeks to close the gaps.

The 90-Day Defender Zero-Day Siege

Nightmare Eclipse began publishing working proof-of-concept exploits on April 2, 2026, opening with BlueHammer, a local privilege escalation (LPE) in Defender’s file remediation engine. What followed was a sustained, deliberate campaign: roughly one new zero-day every two weeks, each dropped with exploit code attached and no coordinated disclosure window. Microsoft confirmed all six vulnerabilities are real and named them in a public Security Response Center statement on May 28, 2026.

The researcher’s stated motive is retaliation. Nightmare Eclipse alleges Microsoft deleted the MSRC account they used to submit reports, paid no bounty, and publicly disparaged them in the CVE-2026-45585 advisory. “When I actively asked you to communicate with me, you refused, humiliated me,” the researcher wrote. GitHub removed the exploit repositories; the code reappeared on GitLab, which also suspended the account. Microsoft has since confirmed its Digital Crimes Unit and law enforcement are involved.

The dispute matters less than the technical reality: six weaponized flaws in the default endpoint protection on over a billion Windows devices, three of which attackers operationalized before any fix existed.

Three Exploited Before Patches Existed

The three confirmed in-the-wild exploits form a logical kill chain. According to technical analysis from Picus Security and incident data from Huntress, the sequence works as follows: an attacker runs UnDefend first to silently disrupt Defender’s definition updates, degrading protection over hours or days. Once detection coverage weakens, they execute BlueHammer or RedSun for SYSTEM-level privilege escalation.

BlueHammer (CVE-2026-33825, CVSS 7.8) exploits a Time-of-Check to Time-of-Use (TOCTOU) race condition in Defender’s remediation logic. An attacker triggers a Defender detection on a crafted file, then swaps that file for a Windows Cloud Files API stub mid-operation. Using NTFS junctions and opportunistic locks, the rollback path is redirected to C:\Windows\System32, where Defender — running as SYSTEM — writes attacker-controlled content. The result is SYSTEM code execution from an unprivileged standard user account.

Huntress observed the first in-the-wild attacks on April 10, four days before Microsoft’s patch landed on April 14. CISA added CVE-2026-33825 to its Known Exploited Vulnerabilities catalog on April 22, ordering federal agencies to patch by May 6, and later updated the entry to confirm ransomware operators have adopted the exploit.

RoguePlanet: The Flaw Still Wide Open

Dropped June 10 — hours after Microsoft’s record 200-CVE Patch Tuesday — RoguePlanet (CVE-2026-50656, CVSS 7.8) targets a TOCTOU race condition in Defender’s real-time scanning engine. A successful exploit spawns a command prompt running as NT AUTHORITY\SYSTEM on fully patched Windows 10 and Windows 11 systems with the June 2026 cumulative update installed. There is no patch as of July 1, 2026; a fix is expected with the July Patch Tuesday or an out-of-band release.

From a SYSTEM shell, an attacker can install persistence, dump LSASS credentials, disable Defender entirely, or pivot to cloud-bound identity tokens. Security researcher Will Dormann confirmed the exploit works, noting it is “reportedly not 100% reliable, but it worked on the first attempt.” The proof-of-concept is public, and exploitation is considered likely given the established pattern with Nightmare Eclipse’s prior releases.

Because there is no vendor patch, the only defenses available are configuration hardening. The mitigations that matter: enable Attack Surface Reduction (ASR) rules that block signed-driver abuse and LSASS credential theft, deploy Windows Defender Application Control (WDAC) or AppLocker to block unknown binaries, strip local admin rights from standard users, and alert on the indicators FunnyApp.exe, RedSun.exe, undef.exe, and z.exe, plus the Defender detection signature Exploit:Win32/DfndrPEBluHmr.BZ.

YellowKey Breaks BitLocker Fast

Nightmare Eclipse also disclosed YellowKey (CVE-2026-45585, CVSS 6.8), a Windows BitLocker security feature bypass. The exploit places specially crafted FsTx files on a USB drive or EFI partition, reboots the machine into Windows Recovery Environment (WinRE), and — by holding the CTRL key during boot — triggers a shell with unrestricted access to the BitLocker-protected volume. Microsoft issued a mitigation advisory on May 20, 2026 and shipped a full patch in the June Patch Tuesday.

The bypass undermines a control many organizations treat as their last line of defense for lost or stolen laptops. If an attacker has brief physical access — a stolen laptop, a left-behind conference device — disk encryption provides no assurance. For cloud security teams, this is not an edge case: endpoint devices cache Entra ID tokens, VPN credentials, and session cookies. A BitLocker break that yields filesystem access often yields a path straight into the cloud tenant.

The Full Vulnerability Map

Patch status and exploitation data compiled July 1, 2026. Sources: DataWater, CISA KEV, SecurityWeek.

Why This Threatens Your Cloud Perimeter

Windows endpoints are the most common entry point to enterprise cloud environments. An attacker who reaches SYSTEM on a domain-joined laptop typically has access to cached Entra ID (Azure AD) tokens, Kerberos tickets, and the OAuth refresh tokens that SSO stacks mint and store locally. Defender is the control expected to block the initial intrusion — and three of Nightmare Eclipse’s exploits either kill Defender’s visibility or use Defender’s own SYSTEM context to escalate.

The BlueHammer-to-ransomware pipeline demonstrates this is not theoretical. CISA’s confirmation that ransomware groups have operationalized CVE-2026-33825 means the same tooling that takes a Windows endpoint can now be the first hop toward encrypting cloud-synced file stores, exfiltrating SharePoint data, or abusing hijacked cloud admin sessions. RoguePlanet, still unpatched, hands attackers the same SYSTEM access on fully patched systems today.

For organizations running cloud-managed endpoint strategies — Intune, Defender for Endpoint, Conditional Access — the lesson is that the assumption “Defender is running, so the device is trusted” no longer holds. Conditional Access policies that grant cloud access based solely on device compliance reports can be defeated if the agent reporting compliance is the same agent being subverted.

SecOps Playbook Before July 14

Nightmare Eclipse has publicly promised a new exploit release on July 14, 2026 — deliberately timed to Patch Tuesday. The stated threat, “I will make sure your bones are shattered that day,” is vague, but the researcher’s track record (six working exploits in 90 days) makes preparation mandatory, not optional.

1. Patch the five fixed CVEs now. Verify BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), and GreenPlasma are patched across all endpoints, including servers and VDI images. Confirm Defender platform version is at least 4.18.26040.1011.
2. Deploy RoguePlanet mitigations immediately. With no patch available, enable ASR rules (block signed-driver abuse, block LSASS credential theft), enforce WDAC or AppLocker, and remove local admin rights. These are the only controls standing between a public PoC and SYSTEM.
3. Harden the cloud trust boundary. Review Conditional Access policies — require phishing-resistant MFA and session risk evaluation, not just device compliance. Treat any Defender-reported “healthy” state with skepticism until RoguePlanet is patched.
4. Stand up monitoring for July 14. Alert on the named indicators (FunnyApp.exe, undef.exe, z.exe, Exploit:Win32/DfndrPEBluHmr.BZ). Schedule an all-hands Patch Tuesday response and pre-stage rollback for rapid deployment.
5. Hunt for prior compromise. BlueHammer and RedSun have been exploitable since April. Run hunts for Defender remediation anomalies, unexpected SYSTEM-spawned processes, and lateral movement toward cloud identity services.

References

• Security Affairs — Microsoft Calls the Zero-Day Dumps Irresponsible
• SecurityWeek — BlueHammer Vulnerability Exploited in Ransomware Attacks
• DataWater — Six Microsoft Defender Zero-Days in 90 Days
• Picus Security — BlueHammer & RedSun CVE-2026-33825 Explained
• BleepingComputer — Microsoft Shares Mitigation for YellowKey
• CISA Known Exploited Vulnerabilities Catalog
• The Hacker News — Three Microsoft Defender Zero-Days Actively Exploited