Loading story…
Microsoft’s fix for the Windows Defender zero-day RoguePlanet (CVE-2026-50656) is facing new scrutiny after researcher Chaotic Eclipse alleged that changes in mpengine.dll introduced fresh problems in the Microsoft Malware Protection Engine. The original flaw was described as a race-condition privilege-escalation bug that could yield a SYSTEM shell and had public proof-of-concept code, adding to mounting pressure on defenders as Microsoft disclosed more than 200 CVEs in a single month across Windows, Office, SharePoint Server, Visual Studio, and .NET.
According to the researcher, the patched engine may expose an eight-byte information disclosure and a more practical denial-of-service condition that can fill local storage by abusing oversized Zone.Identifier alternate data streams during Defender scanning over SMB. In the reported scenario, MsMpEng.exe continues caching content from a controlled SMB server while a later read request is stalled, eventually exhausting disk space; the behavior was reportedly reproduced on Windows 11 25H2 and Windows Server 2025. Microsoft previously addressed RoguePlanet in engine version 1.1.26060.3008, but had not publicly confirmed the alleged post-patch issues at the time of reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Researcher Chaotic Eclipse claimed that Microsoft's RoguePlanet patch introduced an eight-byte information disclosure and a denial-of-service condition that can exhaust local disk space. The behavior was reportedly reproduced on Windows 11 version 25H2 and Windows Server 2025 using a controlled SMB server.
Microsoft previously fixed CVE-2026-50656 in Microsoft Malware Protection Engine version 1.1.26060.3008. The fix is referenced in later reporting about alleged post-patch issues.
CISA said that previously reported Microsoft Defender vulnerabilities, including BlueHammer, are already being exploited by ransomware operators. This indicated active in-the-wild abuse of related Defender flaws.
Microsoft announced RoguePlanet, tracked as CVE-2026-50656, as a Windows Defender zero-day. The flaw was described as a race-condition privilege-escalation issue with public proof-of-concept code capable of yielding a SYSTEM shell.
After patching six ColdFusion vulnerabilities with a maximum CVSS score of 10, Adobe moved to issuing two security releases per month. The change was cited as part of a broader acceleration in vendor patch activity.
In June 2026, Microsoft disclosed more than 200 CVEs, including 116 affecting Windows 11 and 104 affecting Windows 10, and issued fixes across Office, SharePoint Server, Visual Studio, and .NET.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers disclosed **RoguePlanet** and **RedSun**, two Windows local privilege escalation exploits that abuse Microsoft Defender workflows to elevate a standard user to `NT AUTHORITY\SYSTEM` on fully patched Windows systems. RoguePlanet weaponizes Defender’s quarantine pipeline through a design-level race condition involving **NTFS junctions**, **opportunistic locks**, **Volume Shadow Copy**, and the Windows Error Reporting `QueueReporting` scheduled task, while RedSun abuses Defender’s SYSTEM-privileged real-time scanning path with **Cloud Files API placeholders**, batch oplocks, and junctions to redirect privileged writes into `C:\Windows\System32`. Reports said the techniques rely on architectural interactions among legitimate Windows components rather than memory corruption or kernel bugs, making them harder to address with traditional exploit mitigations. RoguePlanet was publicly released by a researcher linked to the **Nightmare-Eclipse** toolset and was reproduced on Windows 11, with one report saying it had no patch or CVE at disclosure and another identifying it as **`CVE-2026-50656`** and stating it was already under active exploitation on Windows 10 and 11. Microsoft Defender reportedly detects a specific RoguePlanet sample as `Exploit:Win32/DfndrRugPlnt.BB`, but researchers said the exploit can remain effective after minor source changes and may succeed reliably on some hardware. RedSun was described as part of a broader offensive toolkit with **BlueHammer** and **UnDefend**; BlueHammer was patched as **`CVE-2026-33825`**, while RedSun and UnDefend were reported as unpatched and active, prompting recommendations to monitor `MsMpEng.exe`, restrict local access, and reduce SMB exposure until fixes are available.
Jul 12, 2026
Microsoft said it is preparing a security update for **RoguePlanet**, a publicly disclosed Microsoft Defender zero-day tracked as `CVE-2026-50656`. The flaw affects fully patched **Windows 10** and **Windows 11** systems and allows local privilege escalation to **SYSTEM** by exploiting a race condition in the **Microsoft Malware Protection Engine**. Researcher **Nightmare Eclipse** released a public proof-of-concept exploit, and reports said the issue can be triggered whether Defender real-time protection is enabled or disabled, with possible impact in passive mode as well. The researcher said the bug may originally have supported remote code execution before Microsoft hardening changes in May blocked some attack paths, after which the exploit was reworked to bypass mitigations. Microsoft acknowledged the vulnerability and said it is investigating while developing a patch. The disclosure comes amid an ongoing dispute between Nightmare Eclipse and Microsoft over bug bounty and coordinated disclosure practices, and follows several other Windows flaws the researcher has publicly exposed, including **BlueHammer**, **RedSun**, **UnDefend**, **GreenPlasma**, and **YellowKey**.
Jul 13, 2026
A proof-of-concept exploit for a new Microsoft Defender local privilege escalation flaw dubbed **RedSun** was published by researcher **Chaotic Eclipse**, with reports saying it works on fully patched **Windows 10**, **Windows 11**, and **Windows Server 2019 and later** when Defender is enabled. The zero-day allows an unprivileged local user to gain **SYSTEM** privileges by abusing Defender’s handling of files tagged by cloud detection, and Microsoft had not released a patch at the time of reporting. Independent researcher **Will Dormann** reportedly validated the exploit chain, which uses the **Windows Cloud Files API**, opportunistic locks, and **NTFS junctions/reparse points** to redirect Defender into overwriting a protected binary under `C:\Windows\System32` and then executing it as SYSTEM. The disclosure followed an earlier Defender privilege-escalation exploit, **BlueHammer**, which Microsoft patched as `CVE-2026-33825`, while defenders were urged to watch for anomalous Defender file writes, `cldapi.dll` activity, and oplock-assisted redirection behavior pending a vendor fix.
Jun 29, 2026