Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control

1. Executive summary

A publicly disclosed proof-of-concept (PoC) exploit named RoguePlanet targets a local elevation-of-privilege (EoP) vulnerability in the Microsoft Malware Protection Engine (the engine behind Microsoft Defender), tracked as CVE-2026-50656. Successful exploitation grants an attacker running on a standard Windows user account full control of the host as NT AUTHORITY\SYSTEM. Microsoft has acknowledged the issue and is preparing a security update; no patch is currently available. The PoC is public, the attack is low-complexity, requires an authenticated local foothold, and requires no user interaction. CVE-2026-50656 is not currently listed in CISA KEV and no CVSS score has been published at the time of writing. For EMEA financial services, the bottom-line risk is that any Windows endpoint or server relying on Microsoft Defender as its primary anti-malware control — and any host where a standard user account can be obtained by an attacker (via phishing, prior malware, contractor account, or shared workstation) — can be elevated to SYSTEM in a single step, bypassing Defender's own active protection. The PoC filename is RoguePlanet.exe.

2. Regulatory framing

DORA Arts. 17, 18, 19 and 24 are not directly engaged by this item in the absence of an actual exploitation event classified as a major ICT-related incident; they will be engaged if exploitation of CVE-2026-50656 is observed and meets reporting thresholds.

3. Technical analysis & attack chain

3.1 Attack chain (confirmed steps)

1. Obtain a local foothold as a standard user. The attacker must already be able to execute code on the target as an authenticated standard user (e.g., via phishing payload, prior malware, contractor account, RDP/VPN credential reuse, or shared workstation). The vulnerability does not provide remote/initial access.
2. Drop or stage RoguePlanet.exe on the target. The PoC is publicly available and is the executable artefact of the exploit.
3. Trigger the race condition in the Microsoft Malware Protection Engine. The vulnerability stems from improper link resolution before file access in the engine (per Help Net Security's reporting on Microsoft's advisory). The PoC exploits a TOCTOU/race-condition window in the high-level Defender code path.
4. Achieve local elevation of privilege. Successful exploitation yields a command shell (per SecurityWeek: "spawn a command prompt with System privileges") running as NT AUTHORITY\SYSTEM.
5. Post-exploitation. With SYSTEM, the attacker has full control: install persistence (services, scheduled tasks, registry Run keys), disable Defender, deploy additional tooling, pivot laterally, access domain credentials in memory (Mimikatz-style), and exfiltrate data.

3.2 Technical specifics

• Affected component: Microsoft Malware Protection Engine (MsMpEng) — the engine used by Microsoft Defender / Windows Security.
• Vulnerability class: Elevation of Privilege via race condition (TOCTOU) combined with improper link resolution before file access.
• CVE: CVE-2026-50656.
• CVSS: Not published at time of writing (verified reference data: CVSS unknown).
• CISA KEV: Not listed at time of writing.
• Exploit characteristics:
• Attack complexity: Low (per Help Net Security reporting).
• Authentication: Required (authenticated local user).
• User interaction: None.
• Privilege gained: NT AUTHORITY\SYSTEM (full system control).
• Reliability: Variable — the researcher states "100% success rate on some machines while it struggled to work on others", indicating the race-condition window is host/timing dependent.
• Active protection bypass: The PoC reportedly works whether active protection is enabled or not; disabling Microsoft Defender does not mitigate the issue and is explicitly not a recommended remediation.
• Exploit artefact filename: RoguePlanet.exe (the PoC executable).
• Researcher / attribution: The PoC was released by researcher "Nightmare Eclipse" (per Help Net Security's Patch Tuesday coverage). The same researcher has previously submitted Microsoft Defender vulnerabilities BlueHammer (CVE-2026-33825), UnDefend (CVE-2026-45498), and RedSun (CVE-2026-41091), plus four other Windows zero-days, all since patched. No MITRE ATT&CK group profile is associated with this activity in the verified reference data; treat any threat-actor attribution as unconfirmed.

3.3 Caveats and unconfirmed claims

• The exact race-condition trigger (which specific Defender code path and which file/link operation) is not detailed in the public reporting; only the high-level description ("high-level part of the Microsoft Defender code", "improper link resolution before file access") is available.
• The PoC's reliability is described qualitatively by the researcher but not quantified in the source material beyond the quoted "100% on some machines" comment.
• No in-the-wild exploitation has been reported in the source material; the public PoC is the only confirmed artefact.

4. Mitigation & containment

P1 — within 24 hours (containment)

• Do not disable Microsoft Defender. Disabling it does not mitigate CVE-2026-50656 and removes your primary anti-malware control.
• Block the PoC artefact by name at EDR/AV and mail/web gateways: RoguePlanet.exe. Use behaviour-based detection (the PoC's behaviour is detectable per Malwarebytes).
• Restrict local code execution on internet-facing and high-value endpoints (Windows servers, jump hosts, domain controllers, trading/treasury workstations) via:
• Application control / WDAC policies that block unknown executables from %TEMP%, %APPDATA%, Downloads, and user-writable paths.
• PowerShell Constrained Language Mode and block execution of unsigned scripts from user context.
• Audit and restrict local accounts that can log in interactively to sensitive hosts; remove unnecessary local user rights; enforce LSA Protection (Credential Guard / RunAsPPL) to limit post-exploitation credential theft.
• Increase EDR telemetry sensitivity for child processes of MsMpEng.exe and for any process spawning cmd.exe / powershell.exe as SYSTEM from a non-Service account context.

P2 — within 72 hours (hardening)

• Apply the Microsoft security update for CVE-2026-50656 as soon as it ships (no fix is currently available; track Microsoft's advisory page for CVE-2026-50656).
• Verify MpEngine / signature version post-patch and confirm the Malware Protection Engine update is present on all endpoints and servers.
• Enable LSA Protection (RunAsPPL) via registry on Windows 10/11 and Server 2016+ hosts to harden credential storage against post-exploitation dumping.
• Review and harden service accounts; ensure no service account has interactive logon rights.
• Validate backups are offline / immutable per the 3-2-1 rule; the source material recommends backing up data to a platform not directly connected to the computer.

P3 — within 7 days (governance)

• Vendor risk record: log CVE-2026-50656 against Microsoft under DORA Arts. 28/30; record the gap window and compensating controls.
• Concentration risk review (DORA Art. 29): document the dependency on Microsoft Defender and the compensating controls in place during the unpatched window.
• User awareness: brief staff on the risk of downloading or running executables from unverified sources, and on the social-engineering risk that delivers the initial standard-user foothold.
• Detection engineering: deploy the YARA and Sigma rules in Section 6 to EDR/SIEM.

5. Indicators of compromise

filename  RoguePlanet.exe

No file hashes, IP addresses, domains, registry keys, mutex names, or C2 indicators were provided in the source material.

6. Detection

YARA rule

rule AT_RoguePlanet_CVE_2026_50656_PoC
{
    meta:
        author = "Adverse Trace"
        date = "2026-06-18"
        description = "Detects the publicly disclosed RoguePlanet PoC artefact and any binary referencing the exploit name or the SYSTEM privilege target used by CVE-2026-50656 (Microsoft Defender EoP)."
        reference = "https://www.malwarebytes.com/blog/news/2026/06/microsoft-working-on-a-fix-for-rogueplanet-a-flaw-that-grants-full-pc-control"
        cve = "CVE-2026-50656"

    strings:
        $name1 = "RoguePlanet" ascii wide nocase
        $name2 = "RoguePlanet.exe" ascii wide nocase
        $priv  = "NT AUTHORITY\\SYSTEM" ascii wide
        $cve   = "CVE-2026-50656" ascii wide

    condition:
        uint16(0) == 0x5A4D and 2 of ($name1, $name2, $cve) or
        uint16(0) == 0x5A4D and $name1 and $priv
}

Sigma rule

title: Suspicious Child of MsMpEng Spawning SYSTEM Shell (CVE-2026-50656 / RoguePlanet)
id: AT-2026-06-18-122-001
status: experimental
description: |
  Detects a child process spawned by the Microsoft Malware Protection Engine
  (MsMpEng.exe) that yields a SYSTEM-level command shell or scripting host,
  consistent with exploitation of CVE-2026-50656 (RoguePlanet) local EoP.
author: Adverse Trace
date: 2026-06-18
references:

  - https://www.malwarebytes.com/blog/news/2026/06/microsoft-working-on-a-fix-for-rogueplanet-a-flaw-that-grants-full-pc-control
  - https://www.securityweek.com/microsoft-working-on-patch-for-rogueplanet-zero-day/
tags:

  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith: "\MsMpEng.exe"
  selection_child_shell:
    Image|endswith:

      - "\cmd.exe"
      - "\powershell.exe"
      - "\pwsh.exe"
      - "\wscript.exe"
      - "\cscript.exe"
      - "\rundll32.exe"
  selection_artefact:
    Image|endswith: "\RoguePlanet.exe"
  condition: selection_parent and selection_child_shell or selection_artefact
falsepositives:

  - Legitimate Microsoft Defender remediation flows that legitimately spawn cmd.exe from MsMpEng.exe (rare; tune as needed)
level: high

CVE assessment

1 referenced CVE

7. Sources

• Malwarebytes — Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control — https://www.malwarebytes.com/blog/news/2026/06/microsoft-working-on-a-fix-for-rogueplanet-a-flaw-that-grants-full-pc-control — 2026-06-18
• SecurityWeek — Microsoft Working on Patch for 'RoguePlanet' Zero-Day — https://www.securityweek.com/microsoft-working-on-patch-for-rogueplanet-zero-day/ — 2026-06-17
• Help Net Security — Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656) — https://www.helpnetsecurity.com/2026/06/17/rogueplanet-zero-day-cve-2026-50656/ — 2026-06-17
• Help Net Security — Record Microsoft Patch Tuesday, fresh zero-day — https://www.helpnetsecurity.com/2026/06/10/microsoft-patch-tuesday-rogueplanet/ — 2026-06-10
• BleepingComputer — Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges — https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-rogueplanet-zero-day-grants-system-privileges/ — 2026-06-17

8. Adverse Trace position

Severity: CVE-2026-50656 is a local, authenticated, low-complexity EoP in a component (Microsoft Malware Protection Engine) that ships with every modern Windows install and that most EMEA financial-services firms rely on as a primary anti-malware control. The PoC is public, requires no user interaction, and yields NT AUTHORITY\SYSTEM — the highest privilege on Windows. While no CVSS score has been published and the CVE is not yet in CISA KEV, the practical impact is high for any host where a standard user account can be obtained. We assess this as a High operational risk for the period until Microsoft ships a fix, particularly for Windows servers, jump hosts, and any endpoint exposed to credential-stuffing or phishing-driven initial access. Client impact: treat as a P1 containment item now (block RoguePlanet.exe, harden local execution, restrict local accounts) and prepare to deploy the Microsoft update out-of-band once available. Next steps: Adverse Trace will (a) monitor Microsoft's advisory for CVE-2026-50656 and push the patch to clients within 24 hours of release, (b) deploy the YARA and Sigma rules in Section 6 to managed EDR/SIEM tenants, and (c) update this advisory to v1.1 with the patch version and any new IOCs as they emerge.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.