Microsoft patches RoguePlanet Defender zero-day flaw

Microsoft ↘ 0.31% has released a security update for the Microsoft Malware Protection Engine to address CVE-2026-50656, a zero-day vulnerability in Microsoft Defender known as RoguePlanet that can grant attackers SYSTEM-level privileges on fully patched Windows machines. The fix arrives roughly a month after the flaw was first publicly disclosed, drawing scrutiny over the timeline.cybersecuritynews+1

A Race Condition at Defender's Core

RoguePlanet was first released on June 9, 2026, by a security researcher operating under the aliases Nightmare Eclipse and Chaotic Eclipse, just hours after Microsoft rolled out its June Patch Tuesday update. The vulnerability exploits a Time-of-Check to Time-of-Use race condition in Defender's real-time scanning engine, allowing a low-privileged local attacker to redirect file operations performed by the engine and spawn a command shell running as NT AUTHORITY\SYSTEM — the highest privilege level on Windows.kudelskisecurity+3

Microsoft formally acknowledged the flaw on June 17, assigning it a CVSS score of 7.8 and stating it was "working to provide a high quality security update". In a statement to BleepingComputer reported by PCWorld, a spokesperson said the company would "provide information in this CVE when the update is available". Multiple independent researchers, including teams at ThreatLocker and Picus Security, confirmed the exploit worked on fully patched Windows 10 and Windows 11 systems, including those with the June 2026 cumulative update installed.threatlocker+4

Weeks Without a Fix

The gap between public disclosure and patch drew criticism from the security community. As of June 25, Kudelski Security noted that "no official security update has been released, and a public proof-of-concept exists that works regardless of whether Defender Real-Time Protection is enabled". The exploit's probabilistic nature — dependent on winning a race condition — offered some mitigation, but organizations were left relying on workarounds such as Windows Defender Application Control in enforced mode or restricting standard users from mounting VHD files.apolocybersecurity+2

RoguePlanet is the fourth Defender vulnerability disclosed by Nightmare Eclipse, following BlueHammer, UnDefend, and RedSun, all of which Microsoft has since patched. Microsoft stated in its advisory that it had not detected active exploitation of the flaw in the wild, though it rated the vulnerability "Exploitation More Likely" on its Exploitability Index.kudelskisecurity+2

What Organizations Should Do Now

The Malware Protection Engine update is delivered automatically through Defender platform updates and Windows Update. Administrators should verify their engine version using the Get-MpComputerStatus PowerShell command and confirm the update has been applied across their fleet. Organizations that implemented interim mitigations — such as WDAC enforcement or ASR rules — should maintain those controls while confirming patch deployment is complete.sentinelone+1