Microsoft Closes Critical Zero-Day Amid Researcher Feud

Microsoft has patched a critical privilege escalation zero-day (CVE-2026-45586) following a contentious public disclosure by a researcher who claims the company violated their vulnerability-handling agreement. The Windows vulnerability required minimal complexity to exploit and could grant attackers full system access, positioning it as a significant threat to users before the patch. This incident underscores growing tensions between security researchers and large tech companies over responsible disclosure practices, raising concerns about whether current protocols adequately protect user security.