Microsoft Criticizes Uncoordinated Disclosure of Six Unpatched Vulnerabilities (infosecurity-magazine.com)

• Microsoft identified six unpatched vulnerabilities disclosed without coordination.
• The company argues this practice puts customers at risk by arming threat actors with exploit code.
• AI-driven research is accelerating vulnerability discovery, questioning the 90-day CVD embargo.
• The EU Cyber Resilience Act's 72-hour notification window may reshape disclosure timelines.

"On May 27, 2026, Microsoft published a bulletin condemning the public disclosure of six unpatched vulnerabilities by an unidentified researcher without prior coordination. The flaws include privilege escalation in Microsoft Defender and BitLocker, a denial-of-service in Defender, and others. Microsoft stated that such disclosures put customers at risk by providing exploit code to adversaries, and urged adherence to coordinated vulnerability disclosure (CVD) processes. The article also reports that AI-accelerated vulnerability research is pressuring the traditional 90-day embargo, with experts suggesting shorter timelines for critical flaws."