RoguePlanet: the vulnerability of Defender that allows to climb SYSTEM with only local code and the patch that comes

Microsoft has published a security update to correct critical vulnerability in its anti-malware engine known as "RoguePlanet" (CVE-2026-50656), almost a month after the details were made public. This is a failure of escalation of privileges in mpengine.dll, the component responsible for scanning and cleaning in the Defense solutions, and was corrected in the engine version 1.1.26060.3008 together with in-depth defence improvements to tighten safety-related functions.

The researcher who released the ruling, known as Chaotic Eclipse (alias Nightmare-Eclipse), described RoguePlanet as a career status which allows the execution of a shell with SYSTEM privileges, which in turn allows the execution of arbitrary code or unauthorized actions. According to reports, the concept test works even on systems with the June 2026 updates applied and no matter if the real-time protection of Defender is activated, which increases the practical gravity of the problem.

From an operational risk perspective, RoguePlanet is significant because it does not require additional remote vulnerabilities: it is enough with a local context (e.g. a process with limited permissions or a deceived user to run code) to climb to SYSTEM. This makes it a useful piece for attackers who seek persistence or to combine it into more complex exploitation chains. For corporate environments this means that threats initially confined to a non-privileged account can quickly become system engagement if the anti-malware engine is not updated or if there are bad privilege management practices.

Microsoft indicates that, under normal conditions, customers should not perform additional actions because engines and definitions are automatically updated with default settings; however, the reality of large organizations usually includes controlled update policies, disconnections or endpoints out of management. That's why it's recommended. actively verify the engine version and update status on critical servers and workstations, especially those using centralized update tools such as Windows Update for Business, Intune or ConfigMgr. Microsoft offers documentation about the engine and its updates that can be used as a reference: Microsoft Malware Protection Engine (documentation).

In addition to applying version 1.1.26060.3008, operational mitigation measures should include the strengthening of minimum privileges policies, review of accounts with high permissions, network segmentation and monitoring of relevant events in Windows records to detect unusual privilege elevations. If a node is suspected to have been exploited, the response should include the collection of evidence and the cleaning or reinstallation according to gravity, and in case of active operation detection contact the corresponding safety support and the response of Microsoft incidents.

The history of the researcher - who has already revealed other vulnerabilities in Defender such as BlueHammer, UnDefender and RedSun - shows two lessons: on the one hand, that software components with high privileges (such as scanning engines) are valuable objectives and, on the other, that it is necessary to maintain and strengthen testing processes (fuzzing, code reviews and time analysis) in critical parts of the security stack. For technical details and the RoguePlanet CVSS score, see the CVE public record: CVE-2026-50656 in NVD.

Finally, although Microsoft has not publicly accredited the researcher on this occasion, the chain of prior and subsequent disclosures is a reminder that responsible disclosure policy and coordination between researchers, suppliers and managers remains key to reducing the exposure window. If you manage Windows systems, confirm engine update, review automatic update configuration and prioritize scans and audits in critical endpoints.