RoguePlanet: Microsoft Defender Zero-Day Grants SYSTEM Privileges, Patched 

Microsoft released an emergency patch on July 9, 2026, for a Microsoft Defender zero-day vulnerability dubbed “RoguePlanet” (CVE-2026-50656) that allows attackers to gain SYSTEM privileges on fully patched Windows 10 and Windows 11 devices (BleepingComputer, 9 Jul 2026). 

The Vulnerability 

CVE-2026-50656 is a race condition in Microsoft Defender that allows an attacker to spawn a command prompt with SYSTEM privileges. The researcher who discovered it, using the handle “Nightmare Eclipse,” reported that the exploit works regardless of whether real-time protection is enabled. Success rate varies by machine from partial to 100%. 

The Disclosure 

The disclosure is notable for the context. The researcher disclosed the flaw after an ongoing dispute with Microsoft over bug bounty and vulnerability disclosure practices. They shared a proof-of-concept exploit in a self-hosted Git repository after Microsoft removed previous repos hosting exploits from GitHub and GitLab. 

Microsoft confirmed it was working on a patch on 16 June 2026. The patch was released on 9 July via Microsoft Malware Protection Engine version 1.1.26060.3008. 

This is part of a broader pattern. The same researcher has previously disclosed multiple Windows zero-days including BlueHammer, RedSun, GreenPlasma, MiniPlasma, YellowKey, and UnDefend. Some affect Defender, others target BitLocker and Windows components. Microsoft fixed GreenPlasma, MiniPlasma, and YellowKey in June 2026 Patch Tuesday. 

Microsoft has responded by issuing warnings of legal action against what it describes as “malicious activity causing real harm to our customers.” 

What to Do 

The patch is delivered automatically through Microsoft Malware Protection Engine updates. Verify your engine version is 1.1.26060.3008 or later by checking C:\Program Files\Windows Defender\MsMpEng.exe properties. 

Sources 

BleepingComputer: Microsoft Patches RoguePlanet Defender Zero-Day Vulnerability, 9 Jul 2026 – https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-rogueplanet-defender-zero-day-vulnerability/ 

– Microsoft Security Response Centre: CVE-2026-50656 

– Microsoft Malware Protection Engine: Version 1.1.26060.3008