Microsoft has confirmed a critical vulnerability, CVE-2026-50656, in Microsoft Defender. The RoguePlanet exploit works on fully updated versions of Windows 10 and 11 for which no patch is currently available.
What Happened
On June 18, 2026, Microsoft officially confirmed a critical vulnerability in Microsoft Defender, dubbed RoguePlanet and tracked as CVE-2026-50656. This is an Elevation of Privilege (EoP) vulnerability—specifically CWE-59—caused by improper symbolic link resolution before file access (Improper Link Resolution Before File Access / Link Following) in the Microsoft Malware Protection Engine, which forms the core of the Microsoft Defender scanning system.
The vulnerability’s CVSS score is 7.8 (Important). An attacker does not need elevated privileges—local access to the system without any user interaction is sufficient. The exploit takes advantage of a so-called TOCTOU race condition (Time-of-Check to Time-of-Use)—a brief window of time between when Defender verifies the file path and when it actually processes the file. A successful attack results in the execution of a command prompt with NT AUTHORITY\SYSTEM privileges—the highest level of privileges in a Windows environment.
What are the consequences of a successful attack?
Successful exploitation of the vulnerability allows an attacker to:
- gain full control of the system with NT AUTHORITY\SYSTEM privileges,
- install software, modify or delete files, and create new user accounts,
- disable security tools, including Defender itself,
- extract login credentials from memory and enable further lateral movement on the network.
The attack is particularly insidious because it works even when Real-Time Protection is disabled—or even when Defender is in passive mode. According to the exploit’s author, signature-based detection of the publicly available PoC code can be easily bypassed with minimal modifications. Microsoft also rates the exploit as “Exploitation More Likely”—meaning it poses a real threat in the near future.
Who Is Affected
The vulnerability affects all Windows 10 and Windows 11 systems—including those with the June cumulative update KB5094126 installed. This means even fully updated devices are at risk. Exchange Online and other cloud services are not affected.
The independent cybersecurity firm ThreatLocker independently reproduced the exploit and confirmed its functionality on fully updated Windows 11 systems. The exploit was disclosed on June 10, 2026—hours after the release of the June Patch Tuesday—by researchers going by the aliases Nightmare Eclipse and Chaotic Eclipse. As of the publication of this article, a patch is not available, and Microsoft has not provided a release date.
What to Do
Microsoft is working on a security patch, and the CVE advisory will be updated once it is released. Until then, we recommend:
- Monitor CVE-2026-50656 and deploy the patch immediately upon its release,
- Review detection rules in SIEM/EDR—according to the PoC author, signature-based mitigations can be easily bypassed with minor code modifications,
- strengthen identity and access protection—deploy MFA and privileged access management (PAM), as RoguePlanet is most dangerous as a second-stage attack following the theft of login credentials,
- Restrict local access to sensitive systems and monitor anomalous behavior at the process level.
Note: Although this is a local exploit, in practice this type of vulnerability is often chained with phishing or credential theft—and a regular user can become an administrator of the entire system.
