Microsoft Patches Windows Defender 'RoguePlanet' Vulnerability CVE-2026-50656

Overview

Microsoft has released a patch for the RoguePlanet vulnerability, a newly discovered security flaw in its Windows Defender software that permits privilege escalation to SYSTEM level on Windows 10 and 11. The vulnerability, identified as CVE-2026-50656, was announced a month earlier by security researcher Nightmare Eclipse, known also as Chaotic Eclipse in some contexts.

Disclosure and Impact

Nightmare Eclipse disclosed the RoguePlanet vulnerability publically after disputes with Microsoft over vulnerability disclosure and bug bounty practices. The flaw is rooted in a race condition in the Microsoft Malware Protection Engine, allowing attackers to execute code with elevated privileges. This could potentially let unauthorized users manipulate system files or perform dangerous operations.

Despite a proof-of-concept being shared, there have been no confirmed reports of this vulnerability being exploited in the wild.

Microsoft's Response

Microsoft confirmed their acknowledgment of the vulnerability in mid-June 2026 and began issuing the necessary patches early July. The update, part of the Microsoft Malware Protection Engine v1.1.26060.3008, applies automatically, with Microsoft assuring users it should remedy the privilege escalation issues. This update also targets broader security reinforcement through unspecified 'defense-in-depth' changes.

Unintended Consequences and Additional Notes

While the patch addresses the privilege escalation threat, Ars Technica reported instances where the update could cause excessive data writing, potentially filling disk space. This emphasizes the importance of continuous monitoring and further testing following any significant software updates to ensure no new vulnerabilities are introduced.