Microsoft Defender Hit by 'RoguePlanet' Zero-Day — CVE-2026-50656, No Patch Yet

Microsoft confirmed on June 17 that Windows Defender contains an unpatched privilege-escalation zero-day, now formally tracked as CVE-2026-50656 (CVSS: 7.8). The company says a patch is in development but has not given a target release date.

What the vulnerability does: CVE-2026-50656 exploits a Time-of-Check-to-Time-of-Use (TOCTOU) race condition in Defender’s real-time scanning engine. When successfully triggered, the exploit spawns a Windows command prompt running as NT AUTHORITY\SYSTEM — the highest privilege level available on a Windows machine. The vulnerability is classified as Important severity, though in practice SYSTEM-level access means an attacker can install software, read credential stores, modify system files, and disable defenses.

Who disclosed it: The exploit was authored and publicly released by a security researcher going by the handle Nightmare Eclipse, who has been releasing exploits for Microsoft zero-days since March 2026, apparently in retaliation for a dispute with the company. The proof-of-concept is publicly available and functional regardless of whether Real-Time Protection is enabled in Defender.

Attack requirements: An authenticated local user account is required — there is no remote code execution component. Attack complexity is rated Low, and no user interaction is needed beyond gaining initial code execution on the target machine. That makes this a reliable privilege-escalation step in post-exploitation chains.

Current risk: Microsoft says it has not detected exploitation in the wild. The Exploitability Index rating is “Exploitation More Likely,” which reflects the low complexity of triggering the race condition once a PoC is available.

What to do right now: No patch is available. Microsoft has not confirmed an out-of-band fix — organizations should assume the fix arrives in July Patch Tuesday (July 14, 2026) unless an emergency advisory states otherwise.

Mitigations to consider in the interim:

Apply least-privilege principles aggressively — this exploit requires an authenticated user, so limiting standard user accounts limits your exposed attack surface.
Monitor for unusual cmd.exe or powershell.exe processes spawned from Defender-related parent processes (MsMpEng.exe).
Ensure EDR solutions log parent-child process relationships so anomalous Defender behavior is detectable.

This is the latest in a pattern of zero-day disclosures from the same researcher. If the cadence holds, additional disclosures may follow before Microsoft closes the gap.

Sources

Related reading