Microsoft Confirms RoguePlanet Defender 0-Day, Patch in Development

Microsoft has officially acknowledged a critical elevation-of-privilege zero-day vulnerability in the Microsoft Malware Protection Engine, the core component powering Microsoft Defender. Tracked as CVE-2026-50656 and publicly dubbed “RoguePlanet”.

The vulnerability was formally published on June 16, 2026, by the Microsoft Security Response Center (MSRC) and carries a CVSS 3.1 score of 7.8 (Important) with no patch currently available and a working public exploit already in circulation.

The flaw is classified as an Elevation of Privilege (EoP) vulnerability, rooted in CWE-59: Improper Link Resolution Before File Access (“Link Following”), and directly affects the Microsoft Malware Protection Engine, the core scanning component embedded in every modern deployment of Microsoft Defender.

Microsoft Confirms RoguePlanet Defender 0-Day

The CVSS vector string describes a locally exploitable flaw requiring only low privileges and no user interaction, with high impact across confidentiality, integrity, and availability.

Two metrics from the advisory stand out as particularly alarming: the Remediation Level is listed as “Unavailable,” and the Exploit Code Maturity is rated “Functional,” together confirming that a fully working public proof-of-concept exists with no official fix in sight.

RoguePlanet was first released on June 10, 2026, just hours after Microsoft concluded its June 2026 Patch Tuesday rollout, by a researcher operating under the aliases Nightmare Eclipse and Chaotic Eclipse.

This is the fourth Microsoft Defender zero-day released by this researcher since March 2026, following BlueHammer, UnDefend, and RedSun all of which Microsoft has since patched.

The timing of the release, immediately after Patch Tuesday, ensured that the next available patching cycle is still weeks away, maximizing the window of exposure across enterprise and consumer environments.

The exploit targets a Time-of-Check-to-Time-of-Use (TOCTOU) race condition in Defender’s real-time scanning engine, exploiting the brief timing gap between when Defender verifies a file path and when it acts on it.

When the race is won successfully, the exploit spawns a Windows command prompt running as NT AUTHORITY\SYSTEM, the highest privilege level on any Windows machine.

Cybersecurity firm ThreatLocker independently reproduced the exploit and confirmed its viability on fully patched Windows 11 systems running the June 2026 cumulative update KB5094126, establishing that no existing update mitigates the risk.

In a particularly alarming development, Nightmare Eclipse confirmed that the PoC operates regardless of whether Defender’s Real-Time Protection is enabled or disabled, and may even function in passive mode.

This eliminates the most intuitive defensive workaround organizations might consider. The exploit’s reliability varies by machine due to its race-condition nature, but the researcher expressed confidence that it can be refined to achieve consistent success rates across a wider range of configurations.

Attempts by the security community to detect or block the exploit through signature-based mitigations have proven largely ineffective, as Nightmare Eclipse noted that minor PoC modifications can bypass any detection rule entirely.

Microsoft has rated CVE-2026-50656 as “Exploitation More Likely” on its Exploitability Index, with public disclosure already confirmed and no observed in-the-wild exploitation as of this writing.

In its advisory, Microsoft stated: “We are working to provide a high quality security update that addresses this vulnerability,” but has not announced a specific patch release date.

The CVE advisory page at MSRC will be updated once the fix is made available. With a functional public PoC, no signature-based workaround, and a patch still in development, security teams should treat this as a high-priority monitoring item.

Enforcing strict least-privilege access controls across all Windows 10 and Windows 11 endpoints, limiting standard user abilities to mount disk images, and deploying SIEM-based detection for anomalous SYSTEM-level shell activity represent the most practical interim measures until Microsoft delivers an official fix.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.