# RoguePlanet: Microsoft Defender Elevation of Privilege Vulnerability (CVE-2026-50656) Patched

> CVE-2026-50656 ("RoguePlanet") is a TOCTOU race-condition flaw in the Microsoft Malware Protection Engine that lets a low-privileged local user escalate to NT AUTHORITY\SYSTEM by manipulating link resolution during file scanning. It is the fourth Defender elevation-of-privilege/evasion flaw disclosed in 2026 by researcher "Chaotic Eclipse" (aka Nightmare-Eclipse), following BlueHammer, RedSun, and UnDefend; Microsoft patched it in Malware Protection Engine 1.1.26060.3008.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T06:17:12.073Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1157
- **ID:** TL-2026-1157
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Actor:** Chaotic Eclipse
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-50656, CVE-2026-33825

## Description

RoguePlanet is a local elevation-of-privilege vulnerability (CWE-59, Improper Link Resolution Before File Access / "link following") in the core scanning component of Microsoft Defender, the Malware Protection Engine (mpengine.dll), which also underlies Microsoft Security Essentials and System Center Endpoint Protection. The flaw is a time-of-check/time-of-use (TOCTOU) race condition: during on-access or on-demand scanning, an attacker with local code execution can win a race between the engine's file-link check and its subsequent file-access operation, redirecting the SYSTEM-privileged scan process onto an attacker-controlled target. Public technical write-ups describe the exploit path as abusing how the engine resolves symbolic/hard links during scanning, culminating in a SYSTEM-level shell — publicly demonstrated regardless of whether Defender Real-Time Protection is enabled, and functioning against fully patched Windows 10 and Windows 11 builds current as of the June 2026 Patch Tuesday cycle.

Microsoft assigned CVE-2026-50656 a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and flagged it "Exploitation More Likely" on its Exploitability Index. Initial public disclosure came June 18-26, 2026, with a working proof-of-concept published before an official patch existed; Qualys reported active exploitation in the wild and issued detection guidance (QID 92413) while the fix was pending. Microsoft ultimately shipped the fix in Malware Protection Engine version 1.1.26060.3008 (delivered via automatic intelligence-update channels rather than a discrete Patch Tuesday KB); all engine builds at or below 1.1.26050.11 are vulnerable.

RoguePlanet is the fourth in a string of 2026 Microsoft Defender zero-days publicly released by the researcher operating as "Chaotic Eclipse" / "Nightmare-Eclipse," who dropped proof-of-concept code for three prior Defender flaws (BlueHammer — CVE-2026-33825, SAM database credential theft via a trusted-file-handling TOCTOU; RedSun, unpatched at time of writing, hijacking the Storage Tiers Management COM object for SYSTEM code execution; and UnDefend, unpatched, degrading detection fidelity by locking Defender's signature/definition files during runtime) as a public protest against Microsoft Security Response Center's handling of the disclosure process. Within roughly two weeks of the BlueHammer/RedSun/UnDefend PoC drops, Huntress Labs confirmed all three were weaponized against live enterprise targets by unrelated intrusion actors, who chained the SYSTEM-level Defender exploits with compromised FortiGate SSL VPN credentials for initial access and deployed a Go-based yamux tunneling implant ("BeigeBurrow") for command-and-control. RoguePlanet follows the identical exploitation pattern (Defender-engine TOCTOU to SYSTEM) and should be treated by defenders as carrying the same weaponization risk even though the source reporting does not yet confirm it inside the same confirmed-intrusion cluster.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1222 File and Directory Permissions Modification
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1069 Permission Groups Discovery
- T1087 Account Discovery
- T1033 System Owner/User Discovery
- T1059 Command and Scripting Interpreter
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1090 Proxy
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1505 Server Software Component
- T1543 Create or Modify System Process
- T1005 Data from Local System
- T1134.002 Access Token Manipulation: Create Process with Token
- T1134.003 Access Token Manipulation: Make and Impersonate Token
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 Indicator Removal: File Deletion
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1106 Native API
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1574.001 DLL
- T1566 Phishing
- T1078.003 Valid Accounts: Local Accounts
- T1518.001 Software Discovery: Security Software Discovery
- T1082 System Information Discovery

## Sources

- [Microsoft fixes RoguePlanet zero-day in Defender](https://www.malwarebytes.com/blog/news/2026/07/microsoft-fixes-rogueplanet-zero-day-in-defender)
- [Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control](https://www.malwarebytes.com/blog/news/2026/06/microsoft-working-on-a-fix-for-rogueplanet-a-flaw-that-grants-full-pc-control)
- ["RoguePlanet" Zero Day MS Defender Privilege Escalation](https://kudelskisecurity.com/research/rogueplanet-zero-day-ms-defender-privilege-escalation)
- [CVE-2026-50656 - Security Update Guide - Microsoft Defender Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656)
- [CVE-2026-50656 RoguePlanet, Defender's Race to SYSTEM](https://www.penligent.ai/hackinglabs/cve-2026-50656/)
- [CVE-2026-50656 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-50656)
- [Microsoft Defender Zero-day Vulnerability Exploited in Attacks (CVE-2026-50656) (RoguePlanet)](https://threatprotect.qualys.com/2026/06/18/microsoft-defender-zero-day-vulnerability-exploited-in-attacks-cve-2026-50656-rogueplanet/)
- [Microsoft Confirms RoguePlanet Zero-Day in Defender, Patch Under Development](https://securityaffairs.com/193830/security/microsoft-confirms-rogueplanet-zero-day-in-defender-patch-under-development.html)
- [Microsoft Defender Zero Day RoguePlanet: When Your Detector Becomes the Attack Surface](https://www.morphisec.com/blog/microsoft-defender-zero-day-rogueplanet-when-your-detector-becomes-the-attack-surface/)
- [Microsoft Releases Patches for RoguePlanet Defender Zero-Day Vulnerability](https://cybersecuritynews.com/rogueplanet-defender-zero-day-vulnerability/amp/)
- [Security Advisory: CVE-2026-50656 ("RoguePlanet") – Microsoft Defender Elevation of Privilege Vulnerability](https://insights.integrity360.com/threat-advisories/security-advisory-cve-2026-50656-rogueplanet-microsoft-defender-elevation-of-privilege-vulnerability)
- [BlueHammer, RedSun & UnDefend: Chaotic Eclipse Adds Unexpected Risk to the April Threat Landscape](https://www.cynet.com/blog/bluehammer-redsun-undefended-chaotic-eclipse-adds-unexpected-risk-to-the-april-threat-landscape/)
- [Nightmare-Eclipse: six zero-days, six weeks and one big grudge](https://blog.barracuda.com/2026/05/19/nightmare-eclipse-zero-days-grudge)
- [Nightmare-Eclipse Tooling Seen in Real-World Intrusion](https://www.huntress.com/blog/nightmare-eclipse-intrusion)
- [BlueHammer, RedSun, and UnDefend: Three Windows Defender Zero-Days Exploited in the Wild](https://socradar.io/blog/bluehammer-redsun-undefend-windows-defender-0days/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1157