Microsoft patches RoguePlanet Defender zero-day vulnerability

1. Executive summary

Microsoft has released Microsoft Malware Protection Engine version 1.1.26060.3008, patching CVE-2026-50656 — a local elevation of privilege zero-day in Microsoft Defender publicly known as "RoguePlanet." The vulnerability stems from improper link resolution before file access (a race condition in the Microsoft Malware Protection Engine) and allows an authenticated, low-privilege attacker to spawn a process with NT AUTHORITY\SYSTEM privileges. A public proof-of-concept exploit was released by the researcher "Nightmare Eclipse" and has been independently confirmed to work on fully patched Windows 10 and Windows 11 systems, regardless of whether Defender real-time protection is enabled. No verified CVSS score, severity rating, or CISA-KEV exploitation state was available in the reference data for this CVE at time of writing. EMEA financial services firms should treat this as a high-priority local privilege escalation risk, particularly on multi-user endpoints, terminal servers, and any environment where an attacker may already hold low-privilege footholds.

2. Regulatory framing

3. Technical analysis & attack chain

Vulnerability: CVE-2026-50656 — Microsoft Defender Elevation of Privilege vulnerability in the Microsoft Malware Protection Engine, publicly referred to as "RoguePlanet."

Root cause: Improper link resolution before file access, exploitable as a race condition in a high-level part of the Microsoft Defender code. The race condition affects the engine's file-access path, allowing an attacker to manipulate the timing of file operations to achieve privilege escalation.

CVSS / Severity / CISA-KEV: No verified CVSS score, severity rating, or CISA-KEV exploitation state was available in the reference data for this item. Do not infer severity from the source text alone.

Affected products: Microsoft Defender (Microsoft Malware Protection Engine) on fully patched Windows 10 and Windows 11. The exploit works regardless of whether Defender real-time protection is enabled or disabled — disabling Defender is explicitly not a mitigation.

Prerequisites: The attacker must be an authenticated local user with standard (non-administrator) privileges. No user interaction is required beyond the attacker executing the exploit. Attack complexity is rated low, though the race condition introduces variability in reliability.

Confirmed attack chain

1. Initial access (pre-existing): Attacker already holds authenticated access to the target system as a standard user. This advisory does not cover how that access was obtained — the vulnerability is a post-access privilege escalation.
2. Exploit execution: Attacker runs the public PoC exploit (RoguePlanet.exe). The exploit triggers a race condition in the Microsoft Malware Protection Engine by exploiting improper link resolution before file access.
3. Race condition window: The exploit relies on precise timing of two events within the Defender engine's file-access workflow. The researcher reports a 100% success rate on some machines but inconsistent results on others, depending on system-specific timing characteristics.
4. Privilege escalation: On successful race condition win, the exploit spawns a command prompt (cmd.exe) running with NT AUTHORITY\SYSTEM privileges — the highest privilege level on Windows.
5. Post-exploitation: With SYSTEM-level access, the attacker has complete control of the system: can modify security products, access all files, create persistence, load kernel drivers, and pivot laterally.

Researcher attribution (unconfirmed)

The exploit was disclosed by a researcher using the handle "Nightmare Eclipse." No MITRE ATT&CK actor profile was available in the verified reference data for this individual, so attribution to any named threat actor is unconfirmed. Nightmare Eclipse has disclosed multiple prior Windows zero-days (BlueHammer/CVE-2026-33825, UnDefend/CVE-2026-45498, RedSun/CVE-2026-41091, GreenPlasma, MiniPlasma, YellowKey), all since patched by Microsoft. The disclosures appear motivated by a dispute with Microsoft over bug bounty and vulnerability disclosure practices. The PoC was self-hosted in a personal Git repository after Microsoft allegedly removed prior exploit repos on GitHub and GitLab. Microsoft has not acknowledged Nightmare Eclipse as the discoverer and has issued warnings of legal action against parties engaged in "malicious activity causing real harm to our customers," which cybersecurity experts interpret as directed at the researcher.

Confidence caveat

Technical details about the vulnerability mechanism (race condition, improper link resolution, SYSTEM-level escalation, PoC reliability) are corroborated across multiple sources (BleepingComputer, Help Net Security, SecurityWeek, Malwarebytes). The researcher's identity and motivation claims are single-sourced (BleepingComputer); verify before enforcement action against individuals.

4. Mitigation & containment

P1 — Within 24 hours

1. Verify Malware Protection Engine version: Check that all Windows 10/11 endpoints have Microsoft Malware Protection Engine version 1.1.26060.3008 or later installed. This is the patch that addresses CVE-2026-50656. - Check via PowerShell: Get-MpComputerStatus | Select-Object AMEngineVersion - Check via registry: HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates → EngineVersion
2. Force engine update on all endpoints: If any endpoint reports an engine version below 1.1.26060.3008, trigger an immediate signature/engine update: - PowerShell: Update-MpSignature - Or via SCCM/Intune deployment of the latest engine package.
3. Do NOT disable Microsoft Defender as a workaround — the PoC works regardless of real-time protection status.

P2 — Within 72 hours

4. Audit endpoint estate: Identify any Windows 10/11 systems that cannot receive automatic engine updates (air-gapped, broken update pipelines, legacy management) and remediate the update path or apply the engine update manually.
5. Hunt for exploitation: Search endpoint telemetry for evidence of RoguePlanet.exe execution or unexpected SYSTEM-spawned command prompts originating from standard-user sessions. See §6 for detection rules.
6. Restrict standard-user execution of unsigned binaries where feasible via AppLocker / WDAC to limit the ability to run the PoC exploit from user-writable directories.

P3 — Within 7 days

7. Confirm 100% engine coverage: Validate via endpoint management reporting that all Windows 10/11 assets show EngineVersion ≥ 1.1.26060.3008.
8. Review multi-user system exposure: Terminal servers, RDS hosts, Citrix VDI, and shared workstations are highest risk because an attacker already has interactive standard-user access. Prioritise these for verification and enhanced monitoring.
9. Update endpoint hardening baselines: Ensure application whitelisting or at least block-list controls prevent execution of binaries from user-profile directories (%APPDATA%, %TEMP%, %USERPROFILE%) where the PoC is likely to be staged.

5. Indicators of compromise

filename  RoguePlanet.exe

6. Detection

YARA rule

rule AT_RoguePlanet_PoC_Exploit {
  meta:
    author = "Adverse Trace"
    date = "2026-07-09"
    reference = "https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-rogueplanet-defender-zero-day-vulnerability/"
    description = "Detects RoguePlanet.exe PoC exploit for CVE-2026-50656 Microsoft Defender LPE"
  strings:
    $filename = "RoguePlanet.exe" wide ascii nocase
  condition:
    $filename
}

Sigma rule

title: RoguePlanet Exploit Execution - CVE-2026-50656
id: AT-2026-07-09-260
status: experimental
description: Detects execution of RoguePlanet.exe PoC exploit targeting Microsoft Defender CVE-2026-50656 local privilege escalation
references:

  - https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-rogueplanet-defender-zero-day-vulnerability/
  - https://www.malwarebytes.com/blog/news/2026/06/microsoft-working-on-a-fix-for-rogueplanet-a-flaw-that-grants-full-pc-control
author: Adverse Trace
date: 2026/07/09
logsource:
  product: windows
  category: process_creation
detection:
  selection_exploit:
    Image|endswith: 'RoguePlanet.exe'
    CommandLine|contains: 'RoguePlanet'
  selection_system_spawn:
    User: 'NT AUTHORITY\SYSTEM'
    ParentImage|contains:

      - 'MsMpEng.exe'
      - 'MpCmdRun.exe'
  condition: selection_exploit or selection_system_spawn
falsepositives:

  - Legitimate security testing in controlled environments
level: high

7. Sources

• BleepingComputer — "Microsoft patches RoguePlanet Defender zero-day vulnerability" — https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-rogueplanet-defender-zero-day-vulnerability/ — 2026-07-09
• BleepingComputer — "Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges" — https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-rogueplanet-zero-day-grants-system-privileges/ — June 2026
• Help Net Security — "Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656)" — https://www.helpnetsecurity.com/2026/06/17/rogueplanet-zero-day-cve-2026-50656/ — 2026-06-17
• Help Net Security — "Record Microsoft Patch Tuesday, fresh zero-day" — https://www.helpnetsecurity.com/2026/06/10/microsoft-patch-tuesday-rogueplanet/ — 2026-06-10
• SecurityWeek — "Microsoft Working on Patch for 'RoguePlanet' Zero-Day" — https://www.securityweek.com/microsoft-working-on-patch-for-rogueplanet-zero-day/ — June 2026
• Malwarebytes Labs — "Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control" — https://www.malwarebytes.com/blog/news/2026/06/microsoft-working-on-a-fix-for-rogueplanet-a-flaw-that-grants-full-pc-control — June 2026
• CrowdStrike — "June 2026 Patch Tuesday: Microsoft Patches 206 Vulnerabilities Including Three Publicly Disclosed Zero-Days" — https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-june-2026/ — June 2026

8. Adverse Trace position

CVE-2026-50656 (RoguePlanet) is a confirmed local privilege escalation vulnerability in the Microsoft Malware Protection Engine with a public, working PoC that achieves SYSTEM-level access from a standard-user context on fully patched Windows 10/11 systems. No verified CVSS score or CISA-KEV exploitation state was available in our reference data at time of writing; we are not re-assessing severity from source text. The patch (Engine 1.1.26060.3008) is now available and should be treated as a priority deployment across all Windows endpoints. The highest-risk assets for EMEA financial services are multi-user systems (RDS, VDI, shared workstations) and any endpoint where an attacker may already hold a low-privilege foothold. Attribution to "Nightmare Eclipse" is unconfirmed — no MITRE actor profile exists in our reference data. We will monitor for any emergence of CISA-KEV listing, confirmed CVSS scoring, or evidence of active exploitation in the wild and will update this advisory if the threat picture changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.