> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control - URL: https://f4n6.co.uk/security-feed/microsoft-working-on-a-fix-for-rogueplanet-a-flaw-that-grants-full-pc-control/ - Published: 2026-06-19T12:10:01.000Z - Updated: 2026-06-19T12:10:01.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-50656 ## 1\. Executive summary A publicly disclosed proof-of-concept (PoC) exploit named **RoguePlanet** targets a local elevation-of-privilege (EoP) vulnerability in the **Microsoft Malware Protection Engine** (the engine behind Microsoft Defender), tracked as **CVE-2026-50656**. Successful exploitation grants an attacker running on a standard Windows user account full control of the host as `NT AUTHORITY\SYSTEM`. Microsoft has acknowledged the issue and is preparing a security update; **no patch is currently available**. The PoC is public, the attack is low-complexity, requires an authenticated local foothold, and requires no user interaction. **CVE-2026-50656 is not currently listed in CISA KEV and no CVSS score has been published at the time of writing.** For EMEA financial services, the bottom-line risk is that any Windows endpoint or server relying on Microsoft Defender as its primary anti-malware control — and any host where a standard user account can be obtained by an attacker (via phishing, prior malware, contractor account, or shared workstation) — can be elevated to SYSTEM in a single step, bypassing Defender's own active protection. The PoC filename is `RoguePlanet.exe`. ## 2\. Regulatory framing | Article | Trigger (fact in this item) | Practical impact | | ------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 — ICT third-party risk — general principles | Microsoft Defender / Malware Protection Engine is an ICT third-party component embedded in the in-scope ICT estate. | Treat Microsoft as an ICT third-party provider for EDR/anti-malware; ensure the relationship is inventoried and risk-assessed under the third-party risk framework. | | DORA Art. 29 — Preliminary assessment of ICT concentration risk | Many firms rely on Microsoft Defender as their primary or sole endpoint anti-malware; this CVE demonstrates a single-vendor concentration on the Malware Protection Engine. | Document concentration on Microsoft Defender and consider compensating controls (secondary EDR, application control, least privilege) for the period until a patch ships. | | DORA Art. 30 — Key contractual provisions with ICT third-party providers | Vendor (Microsoft) has acknowledged a vulnerability but has not yet shipped a fix; SLA / notification clauses apply. | Track Microsoft's advisory and patch release; record the gap window in vendor risk records; ensure contractual notification and remediation clauses are invoked. | | NIS2 Art. 21(2)(d) — Supply chain security measures | The vulnerable component (Microsoft Malware Protection Engine) is supplied as part of the Microsoft software supply chain. | Apply supply-chain security measures to the Defender/Malware Protection Engine component; verify integrity of Defender updates and signatures; restrict local code execution paths that touch the engine. | | UK NIS 2018 — OES/RDSP duties | Windows endpoints/servers operated by in-scope OES/RDSP entities run the affected component. | OES/RDSP operators must assess whether the vulnerability affects systems delivering essential services and apply proportionate mitigation until patched. | DORA Arts. 17, 18, 19 and 24 are **not directly engaged** by this item in the absence of an actual exploitation event classified as a major ICT-related incident; they will be engaged if exploitation of CVE-2026-50656 is observed and meets reporting thresholds. ## 3\. Technical analysis & attack chain ### 3.1 Attack chain (confirmed steps) 1. **Obtain a local foothold as a standard user.** The attacker must already be able to execute code on the target as an authenticated standard user (e.g., via phishing payload, prior malware, contractor account, RDP/VPN credential reuse, or shared workstation). The vulnerability does **not** provide remote/initial access. 2. **Drop or stage `RoguePlanet.exe`** on the target. The PoC is publicly available and is the executable artefact of the exploit. 3. **Trigger the race condition** in the Microsoft Malware Protection Engine. The vulnerability stems from **improper link resolution before file access** in the engine (per Help Net Security's reporting on Microsoft's advisory). The PoC exploits a TOCTOU/race-condition window in the high-level Defender code path. 4. **Achieve local elevation of privilege.** Successful exploitation yields a command shell (per SecurityWeek: "spawn a command prompt with System privileges") running as `NT AUTHORITY\SYSTEM`. 5. **Post-exploitation.** With SYSTEM, the attacker has full control: install persistence (services, scheduled tasks, registry Run keys), disable Defender, deploy additional tooling, pivot laterally, access domain credentials in memory (Mimikatz-style), and exfiltrate data. ### 3.2 Technical specifics - **Affected component:** Microsoft Malware Protection Engine (MsMpEng) — the engine used by Microsoft Defender / Windows Security. - **Vulnerability class:** Elevation of Privilege via race condition (TOCTOU) combined with improper link resolution before file access. - **CVE:** CVE-2026-50656. - **CVSS:** Not published at time of writing (verified reference data: CVSS unknown). - **CISA KEV:** Not listed at time of writing. - **Exploit characteristics:** - Attack complexity: **Low** (per Help Net Security reporting). - Authentication: **Required** (authenticated local user). - User interaction: **None**. - Privilege gained: `NT AUTHORITY\SYSTEM` (full system control). - Reliability: Variable — the researcher states "100% success rate on some machines while it struggled to work on others", indicating the race-condition window is host/timing dependent. - **Active protection bypass:** The PoC reportedly works **whether active protection is enabled or not**; disabling Microsoft Defender does **not** mitigate the issue and is explicitly **not** a recommended remediation. - **Exploit artefact filename:** `RoguePlanet.exe` (the PoC executable). - **Researcher / attribution:** The PoC was released by researcher **"Nightmare Eclipse"** (per Help Net Security's Patch Tuesday coverage). The same researcher has previously submitted Microsoft Defender vulnerabilities **BlueHammer (CVE-2026-33825)**, **UnDefend (CVE-2026-45498)**, and **RedSun (CVE-2026-41091)**, plus four other Windows zero-days, all since patched. **No MITRE ATT&CK group profile is associated with this activity in the verified reference data; treat any threat-actor attribution as unconfirmed.** ### 3.3 Caveats and unconfirmed claims - The exact race-condition trigger (which specific Defender code path and which file/link operation) is not detailed in the public reporting; only the high-level description ("high-level part of the Microsoft Defender code", "improper link resolution before file access") is available. - The PoC's reliability is described qualitatively by the researcher but not quantified in the source material beyond the quoted "100% on some machines" comment. - No in-the-wild exploitation has been reported in the source material; the public PoC is the only confirmed artefact. ## 4\. Mitigation & containment ### P1 — within 24 hours (containment) - **Do not disable Microsoft Defender.** Disabling it does not mitigate CVE-2026-50656 and removes your primary anti-malware control. - **Block the PoC artefact by name at EDR/AV and mail/web gateways:** `RoguePlanet.exe`. Use behaviour-based detection (the PoC's behaviour is detectable per Malwarebytes). - **Restrict local code execution** on internet-facing and high-value endpoints (Windows servers, jump hosts, domain controllers, trading/treasury workstations) via: - Application control / WDAC policies that block unknown executables from `%TEMP%`, `%APPDATA%`, `Downloads`, and user-writable paths. - PowerShell Constrained Language Mode and block execution of unsigned scripts from user context. - **Audit and restrict local accounts** that can log in interactively to sensitive hosts; remove unnecessary local user rights; enforce LSA Protection (Credential Guard / RunAsPPL) to limit post-exploitation credential theft. - **Increase EDR telemetry sensitivity** for child processes of `MsMpEng.exe` and for any process spawning `cmd.exe` / `powershell.exe` as SYSTEM from a non-Service account context. ### P2 — within 72 hours (hardening) - **Apply the Microsoft security update for CVE-2026-50656 as soon as it ships** (no fix is currently available; track Microsoft's advisory page for CVE-2026-50656). - **Verify MpEngine / signature version** post-patch and confirm the Malware Protection Engine update is present on all endpoints and servers. - **Enable LSA Protection (`RunAsPPL`)** via registry on Windows 10/11 and Server 2016+ hosts to harden credential storage against post-exploitation dumping. - **Review and harden service accounts**; ensure no service account has interactive logon rights. - **Validate backups** are offline / immutable per the 3-2-1 rule; the source material recommends backing up data to a platform not directly connected to the computer. ### P3 — within 7 days (governance) - **Vendor risk record:** log CVE-2026-50656 against Microsoft under DORA Arts. 28/30; record the gap window and compensating controls. - **Concentration risk review (DORA Art. 29):** document the dependency on Microsoft Defender and the compensating controls in place during the unpatched window. - **User awareness:** brief staff on the risk of downloading or running executables from unverified sources, and on the social-engineering risk that delivers the initial standard-user foothold. - **Detection engineering:** deploy the YARA and Sigma rules in Section 6 to EDR/SIEM. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | -------- | --------------- | ---------- | ------------------------------------------------- | | filename | RoguePlanet.exe | High | Malwarebytes, BleepingComputer, Help Net Security | ```iocs filename RoguePlanet.exe ``` No file hashes, IP addresses, domains, registry keys, mutex names, or C2 indicators were provided in the source material. ## 6\. Detection ### YARA rule ```yara rule AT_RoguePlanet_CVE_2026_50656_PoC { meta: author = "Adverse Trace" date = "2026-06-18" description = "Detects the publicly disclosed RoguePlanet PoC artefact and any binary referencing the exploit name or the SYSTEM privilege target used by CVE-2026-50656 (Microsoft Defender EoP)." reference = "https://www.malwarebytes.com/blog/news/2026/06/microsoft-working-on-a-fix-for-rogueplanet-a-flaw-that-grants-full-pc-control" cve = "CVE-2026-50656" strings: $name1 = "RoguePlanet" ascii wide nocase $name2 = "RoguePlanet.exe" ascii wide nocase $priv = "NT AUTHORITY\\SYSTEM" ascii wide $cve = "CVE-2026-50656" ascii wide condition: uint16(0) == 0x5A4D and 2 of ($name1, $name2, $cve) or uint16(0) == 0x5A4D and $name1 and $priv } ``` ### Sigma rule ```yaml title: Suspicious Child of MsMpEng Spawning SYSTEM Shell (CVE-2026-50656 / RoguePlanet) id: AT-2026-06-18-122-001 status: experimental description: | Detects a child process spawned by the Microsoft Malware Protection Engine (MsMpEng.exe) that yields a SYSTEM-level command shell or scripting host, consistent with exploitation of CVE-2026-50656 (RoguePlanet) local EoP. author: Adverse Trace date: 2026-06-18 references: - https://www.malwarebytes.com/blog/news/2026/06/microsoft-working-on-a-fix-for-rogueplanet-a-flaw-that-grants-full-pc-control - https://www.securityweek.com/microsoft-working-on-patch-for-rogueplanet-zero-day/ tags: - attack.privilege_escalation - attack.t1068 logsource: product: windows category: process_creation detection: selection_parent: ParentImage|endswith: "\MsMpEng.exe" selection_child_shell: Image|endswith: - "\cmd.exe" - "\powershell.exe" - "\pwsh.exe" - "\wscript.exe" - "\cscript.exe" - "\rundll32.exe" selection_artefact: Image|endswith: "\RoguePlanet.exe" condition: selection_parent and selection_child_shell or selection_artefact falsepositives: - Legitimate Microsoft Defender remediation flows that legitimately spawn cmd.exe from MsMpEng.exe (rare; tune as needed) level: high ``` ## CVE assessment 1 referenced CVE | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ---- | --------- | ---- | ------- | | [CVE-2026-50656](https://nvd.nist.gov/vuln/detail/CVE-2026-50656?ref=f4n6.co.uk) | — | — | — | | ## 7\. Sources - Malwarebytes — *Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control* — https://www.malwarebytes.com/blog/news/2026/06/microsoft-working-on-a-fix-for-rogueplanet-a-flaw-that-grants-full-pc-control — 2026-06-18 - SecurityWeek — *Microsoft Working on Patch for 'RoguePlanet' Zero-Day* — https://www.securityweek.com/microsoft-working-on-patch-for-rogueplanet-zero-day/ — 2026-06-17 - Help Net Security — *Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656)* — https://www.helpnetsecurity.com/2026/06/17/rogueplanet-zero-day-cve-2026-50656/ — 2026-06-17 - Help Net Security — *Record Microsoft Patch Tuesday, fresh zero-day* — https://www.helpnetsecurity.com/2026/06/10/microsoft-patch-tuesday-rogueplanet/ — 2026-06-10 - BleepingComputer — *Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges* — https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-rogueplanet-zero-day-grants-system-privileges/ — 2026-06-17 ## 8\. Adverse Trace position **Severity:** CVE-2026-50656 is a local, authenticated, low-complexity EoP in a component (Microsoft Malware Protection Engine) that ships with every modern Windows install and that most EMEA financial-services firms rely on as a primary anti-malware control. The PoC is public, requires no user interaction, and yields `NT AUTHORITY\SYSTEM` — the highest privilege on Windows. While no CVSS score has been published and the CVE is not yet in CISA KEV, the practical impact is high for any host where a standard user account can be obtained. We assess this as a **High operational risk** for the period until Microsoft ships a fix, particularly for Windows servers, jump hosts, and any endpoint exposed to credential-stuffing or phishing-driven initial access. **Client impact:** treat as a P1 containment item now (block `RoguePlanet.exe`, harden local execution, restrict local accounts) and prepare to deploy the Microsoft update out-of-band once available. **Next steps:** Adverse Trace will (a) monitor Microsoft's advisory for CVE-2026-50656 and push the patch to clients within 24 hours of release, (b) deploy the YARA and Sigma rules in Section 6 to managed EDR/SIEM tenants, and (c) update this advisory to v1.1 with the patch version and any new IOCs as they emerge. --- [Read the original source →](https://www.malwarebytes.com/blog/news/2026/06/microsoft-working-on-a-fix-for-rogueplanet-a-flaw-that-grants-full-pc-control?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*