Microsoft Patches 'RoguePlanet' Defender Zero-Day That Grants SYSTEM Access

Microsoft has shipped a fix for CVE-2026-50656, publicly dubbed “RoguePlanet,” a local privilege escalation vulnerability in the Microsoft Malware Protection Engine — the scanning core behind Windows Defender and several other Microsoft security products. CVSS 4.0 base score: 7.8. Microsoft’s own Exploitability Index rates it “Exploitation More Likely.”

The bug is a race condition triggered by improper link resolution before file access. An authenticated local attacker can exploit it with low complexity and no user interaction to spawn a command shell running with SYSTEM privileges — full control of the machine — even on a fully patched Windows 10 or 11 host. Researcher Chaotic Eclipse (aka Nightmare-Eclipse) publicly disclosed working exploit code before Microsoft had a fix ready. Microsoft closed the gap 29 days later with an emergency update to the Malware Protection Engine, version 1.1.26060.3008.

This is the fourth Defender vulnerability from the same researcher, following BlueHammer (CVE-2026-33825), UnDefend (CVE-2026-45498), and RedSun (CVE-2026-41091) — all patched. The pattern is becoming a liability for Microsoft: the tool meant to stop privilege escalation attacks keeps being the vector for one.

What to do: the Malware Protection Engine updates automatically in most environments and Microsoft’s fix is already live, so most consumer and default-configured enterprise machines are already covered. Verify your engine version is 1.1.26060.3008 or later — check via MpCmdRun.exe -SignatureUpdate or Windows Update history. In managed environments where automatic engine updates are disabled or delayed via WSUS/SCCM policy, force a manual signature and engine update now; don’t wait for the next patch cycle. Because exploitation requires only local authenticated access and no interaction, this is a real risk on shared or multi-user Windows hosts, terminal servers, and any machine where an attacker could already have landed a low-privilege foothold — treat it as a priority patch on those systems specifically.

This lands the same week as Microsoft’s regular July Patch Tuesday cycle, so treat engine-version verification as a separate checklist item from your OS patch rollout — Defender’s engine updates on its own schedule, independent of monthly cumulative updates.

Sources

Related reading