CVE-2026-50656: RoguePlanet Microsoft Defender Zero-Day Local Privilege Escalation (Malware Protection Engine TOCTOU)
CVE-2026-50656 (TL-2026-0835), also tracked as RoguePlanet, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-06-17 and last reviewed 2026-07-10. It is attributed to Nightmare Eclipse with high confidence, affects Microsoft Microsoft Malware Protection Engine (mpengine), references 1 CVE (CVE-2026-50656), maps to 25 MITRE ATT&CK techniques (T1003, T1021, T1027), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0835
- Threat ID
- TL-2026-0835
- Also known as
- RoguePlanet, Nightmare Eclipse
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-06-17
- Last reviewed
- 2026-07-10
- Attribution
- Nightmare Eclipse
- Attribution confidence
- HIGH
- Motivation
- HACKTIVISM
- Target sectors
- technology, government, financial, healthcare, managed-service-providers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
- Updates
- 2026-07-10 · 2 updates · revalidated 2× · latest source
Malware and tooling in CVE-2026-50656
Malware and tooling: Exploit:Win32/DfndrRugPlnt.BB, RoguePlanet PoC
RoguePlanet (CVE-2026-50656) is a Time-of-Check-to-Time-of-Use race condition in the Microsoft Malware Protection Engine (mpengine) that lets an unprivileged local user redirect a file operation performed by MsMpEng.exe (running as NT AUTHORITY\SYSTEM) using NTFS junctions and reparse points, ultimately executing attacker code as SYSTEM. A public proof-of-concept released by researcher 'Nightmare Eclipse' works on fully patched Windows 10 and Windows 11 (including the June 2026 Patch Tuesday build with KB5094126) regardless of real-time protection state.
How CVE-2026-50656 works
CVE-2026-50656, publicly dubbed 'RoguePlanet', is an elevation-of-privilege zero-day in the Microsoft Malware Protection Engine that powers Microsoft Defender. The root cause is a Time-of-Check-to-Time-of-Use (TOCTOU) race condition (CWE-367) combined with improper link resolution before file access (CWE-59): Defender validates a file path and then performs a separate, non-atomic remediation/write as SYSTEM, and an unprivileged attacker redirects the write between those two steps using NTFS path-redirection objects — directory junctions (mount points) and reparse points — so a controlled path resolves to a protected destination.
The published PoC implements a seven-stage chain in which every individual component is a legitimate Windows feature and the vulnerability lives only in the sequence. A self-referential dual-mode binary checks IsRunningAsLocalSystem at entry; in unprivileged mode it acts as orchestrator, in SYSTEM mode it delivers a payload over a named pipe. A high-throughput I/O saturation engine (nicknamed 'Poseidon' — one generator thread plus one worker thread per logical core writing random data to UUID-named temp files) makes the opportunistic-lock (oplock) race windows deterministic rather than probabilistic. The exploit stages an embedded ISO containing a benign-looking wermgr.exe carrying the EICAR test signature inside a working directory at %TEMP%\RP_<UUID>\ with a fake System32 subtree, writes the EICAR content into an NTFS Alternate Data Stream named :WDFOO via low-level NT APIs, polls the \Device NT object directory for new HarddiskVolumeShadowCopy* devices created during Defender remediation, and places an oplock on the VSS-accessed ADS path to pause Defender mid-operation. A junction-swap chain then repoints the fake System32 directory to the mounted ISO and subsequently to a writable wdtest_temp directory, byte-range-locking the ISO's wermgr.exe so Defender is forced to create a quarantine placeholder in attacker-controlled space — yielding a SYSTEM-owned file in attacker-controlled territory. The attacker overwrites that captured quarantine artifact with the exploit binary, atomically renames artifacts to random UUID paths preserving open handles, and converts %TEMP%\RP_<UUID> into a junction targeting C:\Windows so that %TEMP%\RP_<UUID>\System32\wermgr.exe becomes path-equivalent to C:\Windows\System32\wermgr.exe. Finally the orchestrator uses the Task Scheduler COM interface to trigger the Windows Error Reporting 'QueueReporting' scheduled task — which runs as SYSTEM and is triggerable by unprivileged users — causing wermgr.exe to execute the attacker binary, which connects back over the \\.\pipe\RoguePlanet named pipe and spawns an interactive conhost.exe/cmd.exe in the user session at SYSTEM integrity.
RoguePlanet is the latest release in the 'Nightmare Eclipse' campaign (aliases Chaotic Eclipse / Dead Eclipse, handle MSNightmare), an anonymous researcher running an aggressive, roughly-every-10-day cadence of Defender and Windows zero-days characterized by the security press as retaliation over Microsoft's disclosure and bounty handling. It follows BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma (CVE-2026-45586) and a MiniPlasma regression, and was specifically reworked to bypass Microsoft's mid-May 2026 silent hardening of the mpengine!SysIO* API family. The exploit is race-dependent (near-100% reliability on some hardware, near-useless on others), does not work on Windows Server (standard users cannot mount ISOs), and requires Defender real-time protection plus WER infrastructure enabled. Microsoft has confirmed it is investigating and preparing a security update; no patch addressing the root cause existed at disclosure. ThreatLocker independently reproduced the exploit and reported that default application allowlisting (WDAC/AppLocker enforced mode) prevents execution. While RoguePlanet's PoC was unconfirmed in active attacks at publication, Huntress reported earlier Nightmare Eclipse tooling (BlueHammer, RedSun, UnDefend) operationalized in live intrusions, indicating near-term weaponization risk.
MITRE ATT&CK techniques used in TL-2026-0835
Credential Access
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1211 Exploitation for Stealth; T1480 Execution Guardrails; T1564 Hide Artifacts
Execution
T1053 Scheduled Task/Job; T1203 Exploitation for Client Execution; T1559 Inter-Process Communication
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism
lateral-movement
Discovery
T1082 System Information Discovery; T1518 Software Discovery
execution
defense-impairment
T1222 File and Directory Permissions Modification; T1685 Disable or Modify Tools
Impact
T1486 Data Encrypted for Impact
Persistence
T1543 Create or Modify System Process
stealth
Resource Development
Affected products and versions in CVE-2026-50656
- Microsoft — Microsoft Malware Protection Engine (mpengine)
Vulnerable versions: mpengine prior to fixed engine for CVE-2026-50656
Fixed in: engine update forthcoming per MSRC - Microsoft — Windows 10
Vulnerable versions: fully patched incl. June 2026 Patch Tuesday
Fixed in: pending Defender engine update - Microsoft — Windows 11
Vulnerable versions: fully patched incl. June 2026 Patch Tuesday (KB5094126), stable and Canary Insider Preview
Fixed in: pending Defender engine update - Microsoft — Microsoft Defender Antivirus (WinDefend / MsMpEng.exe)
Vulnerable versions: real-time protection enabled
Fixed in: pending Defender engine update
Remediation for CVE-2026-50656
Patches
- Apply the Microsoft Malware Protection Engine update for CVE-2026-50656 once released (engine auto-updates via Defender platform); monitor MSRC advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656
Immediate actions
- Deploy detection for any interactive shell (cmd.exe/powershell.exe/conhost.exe) whose parent is MsMpEng.exe at SYSTEM integrity — a lineage that should never occur in a healthy environment
- Hunt for the named pipe \\.\pipe\RoguePlanet (no legitimate software uses it)
- Hunt for %TEMP%\RP_<UUID>\ working directories and wermgr.exe executing from non-system directories
Workarounds
- Restrict mounting of .vhd/.vhdx/.iso images from email and network locations
- Verify NTFS symlink evaluation is disabled (fsutil behavior query SymlinkEvaluation — ensure R2L/R2R disabled)
- Block outbound SMB (TCP/445, TCP/139) to untrusted hosts to cut the related remote attack surface
Longer-term hardening
- Enforce application allowlisting in enforced mode (WDAC/AppLocker) — ThreatLocker reproduced the exploit and confirmed default allowlisting blocks it
- Enforce least privilege to shrink the unprivileged-user foothold population
- Deploy behavioral detection for reparse-point/junction creation in %TEMP%/%LOCALAPPDATA%/C:\ProgramData and VSS enumeration from non-system processes
CVEs associated with CVE-2026-50656
Weaknesses (CWE) in CVE-2026-50656
CWE-59, CWE-367
Timeline of CVE-2026-50656
- Nightmare Eclipse campaign of recurring Microsoft Defender/Windows zero-days begins, cadence roughly one new release every ~10 days.
- BlueHammer (CVE-2026-33825, CVSS 7.8), the earlier Defender path-redirection exploit in the same campaign, is disclosed and patched.
- Microsoft silently hardens the mpengine!SysIO* API family to disrupt path-redirection attacks against Defender.
- RedSun (CVE-2026-41091) and UnDefend (CVE-2026-45498) Defender exploits in the same campaign are patched.
- GitHub removes the researcher's repositories; copies spread to forums, paste sites, and alternative Git hosts.
- GitLab removes the researcher's repositories, prompting a move to self-hosted projectnightcrawler.dev.
- June 2026 Patch Tuesday fixes YellowKey (CVE-2026-45585), GreenPlasma (CVE-2026-45586), and the MiniPlasma regression.
- RoguePlanet PoC released hours after Patch Tuesday, reworked to bypass the mid-May mpengine!SysIO* hardening; works on fully patched Windows 10/11 (validated against KB5094126).
- CVE-2026-50656 published (NVD/MSRC) with CVSS 7.8 and CWE-59; Microsoft confirms investigation and an update is forthcoming.
- BleepingComputer reports Microsoft is working on a high-quality Defender security update; no patch available at time of reporting.
- Qualys reports RoguePlanet (CVE-2026-50656) being exploited in attacks against fully patched Windows 10/11 hosts, corroborating the record's existing ACTIVE exploitability status.
- Qualys ThreatPROTECT publishes analysis and assigns detection QID 92413; notes no confirmed in-the-wild exploitation at that time.
- Kudelski Security confirms exploit mechanics as a TOCTOU race in the Malware Protection Engine's file-processing workflow and notes Windows Server exploitation requires PoC redesign due to ISO-mounting restrictions.
- Microsoft releases Malware Protection Engine version 1.1.26060.3008, remediating CVE-2026-50656.
- Security media (Help Net Security, BleepingComputer, SecurityWeek, Security Affairs) widely report the RoguePlanet patch release.
Update history for TL-2026-0835
- 2026-07-10 — CVE-2026-50656: Privilege Escalation Race Condition in Microsoft Malware Protection Engine (RoguePlanet): What changed No escalation of severity_level, exploitability, status, cvss_score, or attribution needed — the existing record already reflects ACTIVE exploitability and PATCHED status (MPE 1.1.26060.3008) from a prior revalidation using the
- 2026-07-10 — RoguePlanet: Microsoft Defender Malware Protection Engine Local Privilege Escalation (CVE-2026-50656): What changed Status ACTIVE → PATCHED: Microsoft shipped Malware Protection Engine 1.1.26060.3008 on 2026-07-08/09 remediating CVE-2026-50656, roughly a month after the original PoC/CVE disclosure. Severity/exploitability/CVSS unchanged (sti
Sources cited for CVE-2026-50656
- Microsoft working on Defender patch for RoguePlanet zero-day
- NVD - CVE-2026-50656
- MSRC Security Update Guide - CVE-2026-50656
- RoguePlanet: Anatomy of the Nightmare Eclipse Microsoft Defender Zero-Day
- RoguePlanet: Windows Zero-Day Weaponizes Defender Quarantine Pipeline
- Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows
- Nightmare Eclipse drops RoguePlanet zero-day after Patch Tuesday
- Nightmare Eclipse Drops Yet Another MSFT Exploit, RoguePlanet
- New Windows Defender 0-Day Exploit RoguePlanet Grants SYSTEM Access
- MSNightmare/RoguePlanet PoC repository (PoC-distribution infrastructure)
Threats related to CVE-2026-50656
- LegacyHive Exploitation Chain Bypasses Windows Security Even With July 2026 Patches Installed
- ShieldBreak: Windows Defender Cloud-Hydration Zero-Day Bypasses RoguePlanet Patch (CVE-2026-50656) for SYSTEM-Level Privilege Escalation
- NightmareEclipse Coordinated Disclosure Breach Campaign: 9+ Windows Zero-Days (CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-45585, CVE-2026-45586) Dumped Outside Responsible Disclosure and Weaponized in Real-World Intrusions
- RoguePlanet: Microsoft Defender Elevation of Privilege Vulnerability (CVE-2026-50656) Patched
- LegacyHive: Local Privilege Escalation PoC via Windows User Profile Service (ProfSvc) Registry Hive Mounting
- Windows Defender 0-Day Local Privilege Escalation "RoguePlanet" (Nightmare Eclipse Defender Exploit Series)
Detection coverage for TL-2026-0835
As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0835 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.