RoguePlanet: Microsoft Defender Elevation of Privilege Vulnerability (CVE-2026-50656) Patched
RoguePlanet: Microsoft Defender Elevation of Privilege (TL-2026-1157), also tracked as RoguePlanet, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-07-10. It is attributed to Chaotic Eclipse with high confidence, affects Microsoft Malware Protection Engine, references 2 CVEs (CVE-2026-50656, CVE-2026-33825), maps to 31 MITRE ATT&CK techniques (T1003, T1005, T1033), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-1157
- Threat ID
- TL-2026-1157
- Also known as
- RoguePlanet
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-07-10
- Last reviewed
- 2026-07-10
- Attribution
- Chaotic Eclipse
- Attribution confidence
- HIGH
- Motivation
- HACKTIVISM
- Target sectors
- enterprise, government administration, critical-infrastructure, any windows-defender-deployed organization
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 26
- Updates
- 2026-07-10 · revalidated 1× · latest source
Malware and tooling in RoguePlanet: Microsoft Defender Elevation of Privilege
Malware and tooling: BeigeBurrow, Exploit:Win32/DfndrPEBluHmr.BZ, RoguePlanet PoC exploit (github.com/MSNightmare/RoguePlanet)
CVE-2026-50656 ("RoguePlanet") is a TOCTOU race-condition flaw in the Microsoft Malware Protection Engine that lets a low-privileged local user escalate to NT AUTHORITY\SYSTEM by manipulating link resolution during file scanning. It is the fourth Defender elevation-of-privilege/evasion flaw disclosed in 2026 by researcher "Chaotic Eclipse" (aka Nightmare-Eclipse), following BlueHammer, RedSun, and UnDefend; Microsoft patched it in Malware Protection Engine 1.1.26060.3008.
How RoguePlanet: Microsoft Defender Elevation of Privilege works
RoguePlanet is a local elevation-of-privilege vulnerability (CWE-59, Improper Link Resolution Before File Access / "link following") in the core scanning component of Microsoft Defender, the Malware Protection Engine (mpengine.dll), which also underlies Microsoft Security Essentials and System Center Endpoint Protection. The flaw is a time-of-check/time-of-use (TOCTOU) race condition: during on-access or on-demand scanning, an attacker with local code execution can win a race between the engine's file-link check and its subsequent file-access operation, redirecting the SYSTEM-privileged scan process onto an attacker-controlled target. Public technical write-ups describe the exploit path as abusing how the engine resolves symbolic/hard links during scanning, culminating in a SYSTEM-level shell — publicly demonstrated regardless of whether Defender Real-Time Protection is enabled, and functioning against fully patched Windows 10 and Windows 11 builds current as of the June 2026 Patch Tuesday cycle.
Microsoft assigned CVE-2026-50656 a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and flagged it "Exploitation More Likely" on its Exploitability Index. Initial public disclosure came June 18-26, 2026, with a working proof-of-concept published before an official patch existed; Qualys reported active exploitation in the wild and issued detection guidance (QID 92413) while the fix was pending. Microsoft ultimately shipped the fix in Malware Protection Engine version 1.1.26060.3008 (delivered via automatic intelligence-update channels rather than a discrete Patch Tuesday KB); all engine builds at or below 1.1.26050.11 are vulnerable.
RoguePlanet is the fourth in a string of 2026 Microsoft Defender zero-days publicly released by the researcher operating as "Chaotic Eclipse" / "Nightmare-Eclipse," who dropped proof-of-concept code for three prior Defender flaws (BlueHammer — CVE-2026-33825, SAM database credential theft via a trusted-file-handling TOCTOU; RedSun, unpatched at time of writing, hijacking the Storage Tiers Management COM object for SYSTEM code execution; and UnDefend, unpatched, degrading detection fidelity by locking Defender's signature/definition files during runtime) as a public protest against Microsoft Security Response Center's handling of the disclosure process. Within roughly two weeks of the BlueHammer/RedSun/UnDefend PoC drops, Huntress Labs confirmed all three were weaponized against live enterprise targets by unrelated intrusion actors, who chained the SYSTEM-level Defender exploits with compromised FortiGate SSL VPN credentials for initial access and deployed a Go-based yamux tunneling implant ("BeigeBurrow") for command-and-control. RoguePlanet follows the identical exploitation pattern (Defender-engine TOCTOU to SYSTEM) and should be treated by defenders as carrying the same weaponization risk even though the source reporting does not yet confirm it inside the same confirmed-intrusion cluster.
MITRE ATT&CK techniques used in TL-2026-1157
Credential Access
T1003 OS Credential Dumping; T1552 Unsecured Credentials
Collection
Discovery
T1033 System Owner/User Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1518.001 Software Discovery: Security Software Discovery
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1070.004 Indicator Removal: File Deletion; T1211 Exploitation for Stealth
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1505 Server Software Component; T1543 Create or Modify System Process
Execution
T1059 Command and Scripting Interpreter; T1059.001 Command and Scripting Interpreter: PowerShell; T1106 Native API
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1134.002 Access Token Manipulation: Create Process with Token; T1134.003 Access Token Manipulation: Make and Impersonate Token; T1548 Abuse Elevation Control Mechanism
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1572 Protocol Tunneling
Initial Access
T1078 Valid Accounts; T1078.003 Valid Accounts: Local Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing
defense-impairment
T1222 File and Directory Permissions Modification; T1685 Disable or Modify Tools
stealth
Affected products and versions in RoguePlanet: Microsoft Defender Elevation of Privilege
- Microsoft — Malware Protection Engine
Vulnerable versions: 1.1.26050.11 and earlier
Fixed in: 1.1.26060.3008 - Microsoft — Microsoft Defender Antivirus
Vulnerable versions: Windows 10 and Windows 11 builds current as of June 2026 Patch Tuesday, engine <= 1.1.26050.11
Fixed in: engine 1.1.26060.3008 - Microsoft — Microsoft Security Essentials
Vulnerable versions: engine <= 1.1.26050.11
Fixed in: engine 1.1.26060.3008 - Microsoft — System Center Endpoint Protection
Vulnerable versions: engine <= 1.1.26050.11
Fixed in: engine 1.1.26060.3008
Remediation for RoguePlanet: Microsoft Defender Elevation of Privilege
Patches
- Microsoft Malware Protection Engine 1.1.26060.3008 (fixes CVE-2026-50656)
Immediate actions
- Update Microsoft Malware Protection Engine to version 1.1.26060.3008 or later (delivered automatically via Defender intelligence updates; verify via Windows Security > About or Get-MpComputerStatus).
- Force an immediate Defender platform/engine update check on all Windows 10/11 endpoints (Update-MpSignature / MpCmdRun.exe -SignatureUpdate) rather than waiting for the default update cadence.
- Apply Qualys QID 92413 (or equivalent vulnerability-scanner signature) to fleet-wide scans to confirm remediation.
- Audit for the sibling unpatched Defender flaws (RedSun, UnDefend) and apply Microsoft guidance/mitigations as they become available.
Workarounds
- No effective workaround short of the engine update — disabling Defender Real-Time Protection does NOT prevent exploitation, since the public PoC functions with real-time protection both on and off.
Longer-term hardening
- Deploy prevention-first EDR/behavioral controls that do not solely rely on the Defender Malware Protection Engine for privilege-boundary enforcement.
- Restrict local administrator rights and enforce least-privilege access to reduce the population of accounts that can stage a local TOCTOU race.
- Implement application allowlisting keyed on publisher signature (not path) to blunt local code-execution prerequisites for this exploit class.
- Segment and monitor privileged access; alert on unexpected SYSTEM-level child processes spawned from wermgr.exe or MsMpEng.exe.
CVEs associated with RoguePlanet: Microsoft Defender Elevation of Privilege
Weaknesses (CWE) in RoguePlanet: Microsoft Defender Elevation of Privilege
CWE-59, CWE-367
Timeline of RoguePlanet: Microsoft Defender Elevation of Privilege
- Researcher "Chaotic Eclipse" (Nightmare-Eclipse) publicly releases proof-of-concept code for BlueHammer, an earlier Microsoft Defender SYSTEM privilege-escalation flaw, as a protest against MSRC's disclosure handling.
- Huntress Labs observes threat actors begin weaponizing BlueHammer/RedSun/UnDefend against live enterprise targets, chaining the exploits with compromised FortiGate SSL VPN credentials and the BeigeBurrow yamux tunneling implant.
- Microsoft patches BlueHammer (CVE-2026-33825) in the April 2026 Patch Tuesday release; RedSun and UnDefend, also released by Chaotic Eclipse, remain unpatched.
- Microsoft reportedly hardens certain mpengine SysIO code paths, closing earlier remote-flavored research avenues related to Defender file handling.
- Nightmare Eclipse (Chaotic Eclipse) publishes a working RoguePlanet PoC on a self-hosted Git repository after Microsoft removed prior exploit repos from GitHub and GitLab.
- Microsoft issues an advisory confirming awareness of CVE-2026-50656 in the Malware Protection Engine.
- RoguePlanet (CVE-2026-50656) is publicly disclosed; Qualys ThreatPROTECT publishes advisory describing exploitation in attacks and issues detection QID 92413 while no official patch yet exists.
- Malwarebytes and SecurityAffairs report that Microsoft has confirmed the RoguePlanet zero-day and is developing a fix.
- Kudelski Security publishes detailed technical analysis of the TOCTOU race condition and link-resolution mechanics behind RoguePlanet.
- Integrity360 issues a customer security advisory for CVE-2026-50656, noting a working public PoC and no official patch yet available.
- Qualys ThreatPROTECT updates its RoguePlanet advisory as remediation guidance evolves.
- Microsoft updates its MSRC advisory to announce patch availability via Malware Protection Engine 1.1.26060.3008, one day ahead of rollout completion.
- BleepingComputer, SecurityWeek, TheHackerNews, and PCWorld publish coverage of the patch and the researcher's ongoing bug-bounty dispute with Microsoft.
- Microsoft ships Malware Protection Engine version 1.1.26060.3008, fixing CVE-2026-50656; Malwarebytes and cybersecuritynews.com report the patch's release.
Update history for TL-2026-1157
- 2026-07-10 — RoguePlanet: Microsoft Defender Race Condition Privilege Escalation (CVE-2026-50656): What changed Attribution confidence MEDIUM → HIGH on stronger identification of the researcher/PoC provenance (self-hosted repo, prior GitHub/GitLab takedowns, consistent alias pattern across BlueHammer/UnDefend/RedSun/RoguePlanet). Severit
Sources cited for RoguePlanet: Microsoft Defender Elevation of Privilege
- Microsoft fixes RoguePlanet zero-day in Defender
- Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control
- "RoguePlanet" Zero Day MS Defender Privilege Escalation
- CVE-2026-50656 - Security Update Guide - Microsoft Defender Elevation of Privilege Vulnerability
- CVE-2026-50656 RoguePlanet, Defender's Race to SYSTEM
- CVE-2026-50656 Detail
- Microsoft Defender Zero-day Vulnerability Exploited in Attacks (CVE-2026-50656) (RoguePlanet)
- Microsoft Confirms RoguePlanet Zero-Day in Defender, Patch Under Development
- Microsoft Defender Zero Day RoguePlanet: When Your Detector Becomes the Attack Surface
- Microsoft Releases Patches for RoguePlanet Defender Zero-Day Vulnerability
- Security Advisory: CVE-2026-50656 ("RoguePlanet") – Microsoft Defender Elevation of Privilege Vulnerability
- BlueHammer, RedSun & UnDefend: Chaotic Eclipse Adds Unexpected Risk to the April Threat Landscape
- Nightmare-Eclipse: six zero-days, six weeks and one big grudge
- Nightmare-Eclipse Tooling Seen in Real-World Intrusion
- BlueHammer, RedSun, and UnDefend: Three Windows Defender Zero-Days Exploited in the Wild
Threats related to RoguePlanet: Microsoft Defender Elevation of Privilege
- NightmareEclipse Coordinated Disclosure Breach Campaign: 9+ Windows Zero-Days (CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-45585, CVE-2026-45586) Dumped Outside Responsible Disclosure and Weaponized in Real-World Intrusions
- Windows Defender 0-Day Local Privilege Escalation "RoguePlanet" (Nightmare Eclipse Defender Exploit Series)
- LegacyHive: Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day PoC (Unpatched, No CVE)
- CVE-2026-33825: Microsoft Defender Local Privilege Escalation via BlueHammer TOCTOU Race Condition
- CVE-2026-50656: RoguePlanet Microsoft Defender Zero-Day Local Privilege Escalation (Malware Protection Engine TOCTOU)
- FalconFlank: Unpatched Local Privilege Escalation PoC in CrowdStrike Falcon Sensor via Office Macro Remediation
Detection coverage for TL-2026-1157
As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1157 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.