This is the latest zero-day released by security researcher Nightmare Eclipse, despite Microsoft publicly threatening to take legal action against them.

Microsoft patches 398 flaws, including exploited CVE-2026-68820 that lets local attackers reach SYSTEM, plus four unauthenticated 9.8 RCEs.

The PoC posted by Nightmare Eclipse, who has been feuding with Microsoft for months, grants an attacker system-level privileges once they gain any access.