Microsoft Reasserts Coordinated Disclosure Norms After Researcher Drops Zero-Days
Redmond is invoking CVD principles after a researcher publicly posted unpatched flaws, raising fresh questions about the boundary between disclosure ethics and platform enforcement.
Key points - A researcher known as Chaotic Eclipse and Nightmare-Eclipse publicly posted multiple zero-days without prior notice to Microsoft. - Microsoft restated its Coordinated Vulnerability Disclosure position, asking researchers to report privately before going public. - Public, pre-patch disclosure forfeits bug bounty eligibility but doesn't, on its own, violate U.S. Law. - Platform providers retain broad contractual discretion to remove repositories containing active exploit code. - Incoming EU and U.S. Reporting rules raise the stakes for vendors on documenting what they knew and when.
What did the researcher actually do?
A researcher operating under the handles Chaotic Eclipse and Nightmare-Eclipse posted details of multiple zero-days without first notifying Microsoft. The posts, since removed from the hosting platform, included proof-of-concept material for issues Microsoft says weren't reported through its Security Response Center intake. MSRC's published policy, available at the MSRC researcher portal, asks for private submission and offers bounty eligibility under the terms of each specific program. Public, pre-patch disclosure forfeits that eligibility.
Is this illegal?
It isn't, at least not automatically. The Department of Justice's 2022 CFAA charging policy explicitly declines to prosecute good-faith security research, though that policy is a charging guideline rather than a statutory safe harbor. Platform terms are a separate matter: code-hosting providers retain broad contractual discretion to pull repositories containing active exploit code, and account takedowns in this category are routine.
Should you worry about CVD as a norm?
CVD isn't law. It's a norm, codified in industry practice and in voluntary standards covering vulnerability disclosure and handling. Neither standard carries an enforcement trigger against an independent researcher. What they do is set expectations for vendor behavior, acknowledgment timelines, remediation cadence, credit, in exchange for which researchers are asked to hold publication. That bargain only works if both sides perform.
Microsoft's appeal lands in a regulatory environment that increasingly pulls vulnerability handling into formal rule. We've covered the Act's implications across four stories since the site launched, including how its disclosure timelines interact with incident-reporting frameworks still being finalized elsewhere.
In the U.S., CISA's CIRCIA final rule remains pending. The notice of proposed rulemaking closed its comment period in July 2024, and the agency has signaled a final rule by late 2025. Neither regime regulates third-party researcher conduct directly. Both raise the stakes for how vendors document what they knew and when.
That's the subtext of Microsoft's statement. A vendor that learns of a flaw via a public post, rather than a private report, has a much harder time meeting any mandatory reporting clock with anything more than an acknowledgment.
What to watch next
The affected CVEs, if any have been assigned, weren't identified in Microsoft's communication. The real question isn't whether this researcher broke rules; they didn't, in any enforceable sense. It's whether public drops like this one accelerate regulatory pressure on researchers themselves, territory that neither CIRCIA nor the Cyber Resilience Act currently covers but that legislators on both sides of the Atlantic are watching. Researchers seeking to coordinate can submit through the MSRC portal; bounty terms are listed per product family on the Microsoft Bug Bounty page.
