Microsoft Defender RoguePlanet Zero-Day Enables SYSTEM Privilege Escalation

Microsoft said it is preparing a security update for RoguePlanet, a publicly disclosed Microsoft Defender zero-day tracked as CVE-2026-50656. The flaw affects fully patched Windows 10 and Windows 11 systems and allows local privilege escalation to SYSTEM by exploiting a race condition in the Microsoft Malware Protection Engine. Researcher Nightmare Eclipse released a public proof-of-concept exploit, and reports said the issue can be triggered whether Defender real-time protection is enabled or disabled, with possible impact in passive mode as well.

The researcher said the bug may originally have supported remote code execution before Microsoft hardening changes in May blocked some attack paths, after which the exploit was reworked to bypass mitigations. Microsoft acknowledged the vulnerability and said it is investigating while developing a patch. The disclosure comes amid an ongoing dispute between Nightmare Eclipse and Microsoft over bug bounty and coordinated disclosure practices, and follows several other Windows flaws the researcher has publicly exposed, including BlueHammer, RedSun, UnDefend, GreenPlasma, and YellowKey.