RoguePlanet the vulnerability of Defender that could open a console with SYSTEM privileges after the June patches

In the middle of an update of June 2026 a researcher who calls himself Nightmare Eclipse published an explosion called "RoguePlanet" that attacks Microsoft Defender, just hours after Microsoft delivered patches during the Patch Tuesday. According to the developer, vulnerability takes advantage of a career status in the Defense engine to raise privileges and, in the tests you have shown, you can open a system symbol with privileges SYSTEM on Windows 10 and Windows 11 with the latest updates installed.

The exchange of information is not neutral: the publication comes in the context of a public dispute between the researcher and Microsoft about outreach practices and rewards. Nightmare Eclipse ensures that its previous repositories were removed from platforms such as GitHub and GitLab, so this time he published the PoC in a self-housed repository and his personal blog. Microsoft, for its part, has reiterated in its public policy the need for coordinated disclosure and has warned about possible legal consequences when the activity causes real damage to customers; this position is reflected in its statement on responsible disclosure.

From the technical point of view there are important nuances: the author himself indicates that the failure was initially developed with the capacity to remote code execution (CERs) exploiting how Defender handles files hosted in external SMB resources - e.g. .vhd (x) remote - but claims that Microsoft applied hardships in May that blocked some junction-based vectors and remote exploitation in certain scenarios. The public version of the PoC now circulating seems to focus on the local lift of privileges (LPE), and also its effectiveness varies by career condition: some teams reproduce the explosion consistently, others do not.

The independent confirmation changes the conversation: the firm ThreatLocker claimed to have replicated the technique against systems with the June patches and published evidence on video, as well as to point out that the application allowing prevented the execution of the explosion in its tests. This observation brings an immediate practical conclusion: in-depth defenses and implementation controls are effective even when the operating system has a design vulnerability in a security component.

What should administrators and users do now? First of all, not to trust that only applying patches ends the risk: RoguePlanet shows that a security component can be objective and that public PoC speed up the exposure window. I recommend prioritizing in production environments the activation or strengthening of application allowlisting, reviewing and tightening SMB access policies (blocking incoming SMB from the Internet, limiting shared resources and mounting VHDs from unreliable locations), and restricting the assembly of disk images to minimum groups of administrators. It is also appropriate to enable the monitoring of the creation of processes and alerts on atypical instances of MsMpEng / Defend that launch cmd.exe or processes with high privileges, and to deploy detection rules in ICES / EDR that capture behaviors associated with career conditions in antivirus engines.

For response teams and Red Team is key test in laboratory before deploying mass changes: validate mitigation, measure impact and ensure that detection rules do not generate excessive noise. Attack simulation tools and services can help to verify the effectiveness of controls (e.g. reports and continuous validation solutions); if you want to read an approach to defence layer testing you can consult specialized resources that explain why it is appropriate to evaluate IMS and EDR with real scenarios.

Finally, there is an ethical and operational dimension: the publication of PoC by researchers who feel that their reports were not addressed raises legitimate questions about coordination between companies and the community. The sustainable solution is through more transparent outreach processes and, where necessary, through neutral time-bound forums for public communication and parking. In the meantime, organizations should not wait for additional patches: hardening configurations, network-building and implementation policies and audit are concrete and effective mitigation measures against exploits that abuse safety components.

For more context on Microsoft's position on coordinated outreach, see its public release on the MSRC portal: Microsoft MSRC - A shared responsibility, and to see the researcher's publication where he describes the original development and scenarios visit his blog: dedeclipse666.blogspot.com. If you want to deepen the testing of controls and resilience tests, this resource on continuous evaluation and attack simulation may be useful: Test every layer before attacks do.