Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges
The vulnerability, tracked as CVE-2026-50656 (CVSS score: 7.8), is a privilege escalation issue in the Microsoft Malware Protection Engine ("mpengine.dll"), which provides scanning, detection, and cleaning capabilities for its antivirus and antispyware…
Ravie LakshmananJul 09, 2026Vulnerability / Endpoint Security * Microsoft has released security updates for a Defender vulnerability known as RoguePlanet, nearly a month after details of the flaw became public.
The vulnerability, tracked as CVE-2026-50656 (CVSS score: 7.8), is a privilege escalation issue in the Microsoft Malware Protection Engine ("mpengine.dll"), which provides scanning, detection, and cleaning capabilities for its antivirus and antispyware software.
The issue has been remediated in Microsoft Malware Protection Engine version 1.1.26060.3008, along with defense-in-depth updates to harden unspecified security-related features.
RoguePlanet was first disclosed by a security researcher named Chaotic Eclipse (aka Nightmare-Eclipse), describing it as a race condition that could be abused to spawn a shell with SYSTEM-level privileges. This, in turn, grants the attacker the ability to run arbitrary code or perform unauthorized actions.
* The exploit has been found to work on systems running up-to-date versions of Windows with the June 2026 Patch Tuesday updates installed. Subsequently, Chaotic Eclipse also revealed that the exploit works regardless of whether real-time protection is on or not. Microsoft has not officially credited Chaotic Eclipse with the vulnerability discovery.
RoguePlanet is the fourth Defender vulnerability disclosed by the researcher after BlueHammer (CVE-2026-33825), UnDefend (CVE-2026-45498), and RedSun (CVE-2026-41091), all of which have since been patched by Microsoft.
The Windows maker said no customer action is required to install the update for CVE-2026-50656, as the software is frequently updated to secure customers against new and evolving threats.
"For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically," Microsoft said.
"Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
SHARE Antivirus, cybersecurity, endpoint security, exploit, Microsoft, Patch Management, privilege escalation, Threat Detection, Vulnerability, Windows Security
Related Articles
Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory
"The script looked for the Domain Controller (DC) and mapped users, computers, and domains, before creating a directory and exporting out a number of files, and finally creating AD Report.html to measure the success of…
Meta Files Patent for AI That Can Listen All Day and Track How You're Feeling
Each read gets pinned to the moment it happened: the time, your location, what you were doing, even how you were using your phone. Some versions in the filing would listen all day; others would check in only at set…
Thinking Fast and Slow in the SOC: The Case for Combining Autonomous AI with Analyst Copilots
On the flight home, I picked up a book I had not touched in a few years. Daniel Kahneman's Thinking, Fast and Slow. Kahneman is one of the rare people who genuinely changed how we understand human decisionmaking. He…