CVE-2026-45586

Nightmare Eclipse, a bug hunter with a reported grudge against Microsoft, disclosed a new zero-day vulnerability called RoguePlanet targeting Microsoft Defender on Windows 10 and 11. The flaw allows local privilege escalation to SYSTEM-level access and is part of seven zero-days the researcher has publicly released, accusing Microsoft of ignoring vulnerability reports and refusing communication. Microsoft initially responded with potential legal threats but later clarified it had 'no intention to pursue action' against security researchers.