RoguePlanet CVE-2026-50656: Microsoft Defender SYSTEM Privilege Escalation Patched

Microsoft has finally released a security update for the RoguePlanet CVE-2026-50656 vulnerability. This flaw allowed local attackers to escalate privileges to SYSTEM level through a race condition in the Microsoft Malware Protection Engine. The patch arrives nearly one month after the vulnerability was publicly disclosed by security researcher Chaotic Eclipse.

However, the researcher also discovered a new side effect in the defense-in-depth updates. These changes can cause Defender to leak up to 8 bytes of data in certain file-opening scenarios. Consequently, defenders should monitor for additional updates as Microsoft investigates this new finding.

What Happened: RoguePlanet Defender Flaw Grants SYSTEM Access

The RoguePlanet vulnerability is a privilege escalation flaw in the Microsoft Malware Protection Engine. This engine, implemented in mpengine.dll, provides scanning, detection, and cleaning for Microsoft Defender Antivirus. The vulnerability carries a CVSS score of 7.8 and is classified as Important.

Chaotic Eclipse, also known as Nightmare-Eclipse, first disclosed the flaw in June 2026. The researcher described it as a race condition that attackers could exploit to spawn a shell with SYSTEM privileges. Moreover, the exploit works even when real-time protection is turned off. This makes the flaw particularly dangerous because traditional antivirus mitigations do not prevent exploitation.

Microsoft published the vulnerability in its security advisory on June 16, 2026. The company stated it was working on a patch but did not provide a timeline. Furthermore, Microsoft did not officially credit Chaotic Eclipse with the discovery. This follows a pattern from previous Defender disclosures by the same researcher.

The patch was released on July 9, 2026, as part of an update to the Malware Protection Engine version 1.1.26060.3008. In addition to fixing the race condition, Microsoft included defense-in-depth updates to harden unspecified security features.

Technical Details of the RoguePlanet Vulnerability

The RoguePlanet flaw exists in the Microsoft Malware Protection Engine. This component runs with elevated privileges and processes files for malware detection. The race condition occurs during this scanning process.

An attacker with local access can trigger the race condition to gain SYSTEM-level access. For example, a standard user account could exploit this flaw to run arbitrary code with full system privileges. This completely bypasses Windows user access controls.

The exploit has been confirmed to work on fully patched Windows systems. Even systems with the June 2026 Patch Tuesday updates installed remained vulnerable. Therefore, the July engine update was essential to close this gap.

RoguePlanet is the fourth Defender vulnerability disclosed by Chaotic Eclipse in 2026. The previous flaws include:

• BlueHammer (CVE-2026-33825) — a privilege escalation flaw disclosed in April
• UnDefend (CVE-2026-45498) — an actively exploited vulnerability disclosed in May
• RedSun (CVE-2026-41091) — another privilege escalation flaw disclosed in May

All three previous vulnerabilities have since been patched by Microsoft. However, the recurring pattern suggests deeper architectural issues in the Malware Protection Engine.

New Data Leak Side Effect in Defense Updates

On July 9, 2026, Chaotic Eclipse published additional findings about the defense-in-depth updates. The researcher discovered that the new protections can cause Defender to leak 8 bytes of data when attempting to open certain files.

“I’m still trying to find a way to obtain the leaked bytes as a standard user but for now it only leaks data to drivers,” the researcher stated. This suggests the leak may require specific conditions to exploit.

The finding also revealed an exception in Defender’s file size limits. Normally, Defender enforces strict size limits on quarantined files to prevent disk exhaustion. However, the SpyNet functions in mpengine.dll cache Zone.Identifier Alternate Data Stream (ADS) files regardless of size. A malicious actor could potentially abuse this behavior through a custom SMB server serving malicious files with oversized ADS metadata.

Business and Operational Impact

The RoguePlanet vulnerability poses serious risks to both enterprise and consumer environments. Any Windows system running Microsoft Defender is potentially affected. This includes Windows 10, Windows 11, and Windows Server installations.

The primary impacts include:

• Complete system compromise: An attacker with local access can escalate to SYSTEM and take full control of the machine
• Lateral movement: Compromised endpoints can serve as launch points for broader network attacks
• Persistence: SYSTEM-level access allows attackers to install rootkits and maintain long-term access
• Data theft: Elevated privileges enable access to all files and credentials stored on the system
• Ransomware deployment: Attackers can disable security tools and deploy ransomware with maximum impact

For enterprise environments, the risk is particularly acute. A single compromised endpoint can lead to domain-wide compromise if the attacker harvests credentials. Moreover, the vulnerability works even with real-time protection enabled. This means organizations cannot rely on Defender alone to prevent exploitation.

Mitigation and Recommendations

Microsoft has addressed the core vulnerability in Malware Protection Engine version 1.1.26060.3008. No manual action is required for most users because Defender updates automatically.

Immediate Actions for Defenders

1. Verify engine version: Check that Microsoft Defender is running engine version 1.1.26060.3008 or later
2. Force manual update: If automatic updates are disabled, manually trigger a definition and engine update immediately
3. Monitor for suspicious local activity: Watch for unusual privilege escalation attempts on endpoints
4. Apply principle of least privilege: Restrict local administrator accounts to reduce attack surface
5. Enable tamper protection: Ensure Microsoft Defender tamper protection is active to prevent attackers from disabling security features

Enterprise-Specific Guidance

For managed enterprise environments, administrators should verify update policies. The Microsoft Malware Protection Engine updates through Windows Update, Microsoft Update, or WSUS depending on configuration. Also, check that third-party security products relying on mpengine.dll have received the update.

Monitor for Future Updates

The newly discovered data leak side effect may require additional patches. Therefore, security teams should track Microsoft’s security advisories for further updates to the Malware Protection Engine.

Bottom line: Apply the July 2026 Microsoft Defender engine update immediately. Also, review local privilege escalation controls and prepare for potential follow-up patches addressing the data leak finding.

Summary

CVE ID / Incident:	CVE-2026-50656 (RoguePlanet)
Affected Systems:	Microsoft Defender Antivirus on Windows 10, Windows 11, and Windows Server
Disclosure Date:	June 16, 2026 (patched July 9, 2026)
Patch Status:	Patch available in Malware Protection Engine version 1.1.26060.3008
CVSS Score:	7.8 (Important)
Attack Vector:	Local privilege escalation via race condition
Exploitation Status:	Publicly disclosed with proof-of-concept; no confirmed in-the-wild exploitation reported

References

1. Microsoft Security Response Center, “CVE-2026-50656,” July 2026, https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-50656, accessed July 10, 2026.
2. The Hacker News, “Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges,” July 9, 2026, https://thehackernews.com/2026/07/microsoft-patches-rogueplanet-defender.html, accessed July 10, 2026.
3. Chaotic Eclipse (Nightmare-Eclipse), “Some Interesting Findings in Windows Defender,” July 9, 2026, https://blog.projectnightcrawler.dev/posts/2026-07-09-some-interesting-findings-in-windows-defender/, accessed July 10, 2026.
4. National Vulnerability Database, “CVE-2026-50656 Detail,” June 16, 2026, https://nvd.nist.gov/vuln/detail/CVE-2026-50656, accessed July 10, 2026.