Microsoft is threatening legal action and law enforcement referrals against a security researcher who publicly disclosed a series of unpatched vulnerabilities in its products, a move that has drawn sharp criticism from the cybersecurity community.