Loading story…
A newly disclosed Microsoft Defender vulnerability tracked as CVE-2026-50656 and dubbed RoguePlanet allows a low-privileged attacker to gain SYSTEM privileges by exploiting a time-of-check/time-of-use (TOCTOU) race condition in the Microsoft Malware Protection Engine’s remediation workflow. According to public reporting, the issue lies in Defender’s quarantine and remediation process, turning the security product itself into an attack surface that can be abused during malware handling.
Public detection content has already begun to appear, including a Nuclei template proposal designed to identify signs of exploitation through suspicious quarantine artifacts and remediation logs. The template references the Morphisec disclosure and describes checks intended to help defenders spot abuse of the quarantine mechanism, giving security teams an early way to hunt for potential exploitation while assessing exposure to the Microsoft Defender privilege-escalation flaw.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A ProjectDiscovery nuclei-templates pull request proposed a detection template for CVE-2026-50656 to identify suspicious quarantine artifacts and remediation logs associated with RoguePlanet exploitation.
Morphisec published a blog post disclosing RoguePlanet, identified as CVE-2026-50656, describing it as a Microsoft Defender elevation-of-privilege zero-day involving the Microsoft Malware Protection Engine remediation workflow.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcemorphisec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said it is preparing a security update for **RoguePlanet**, a publicly disclosed Microsoft Defender zero-day tracked as `CVE-2026-50656`. The flaw affects fully patched **Windows 10** and **Windows 11** systems and allows local privilege escalation to **SYSTEM** by exploiting a race condition in the **Microsoft Malware Protection Engine**. Researcher **Nightmare Eclipse** released a public proof-of-concept exploit, and reports said the issue can be triggered whether Defender real-time protection is enabled or disabled, with possible impact in passive mode as well. The researcher said the bug may originally have supported remote code execution before Microsoft hardening changes in May blocked some attack paths, after which the exploit was reworked to bypass mitigations. Microsoft acknowledged the vulnerability and said it is investigating while developing a patch. The disclosure comes amid an ongoing dispute between Nightmare Eclipse and Microsoft over bug bounty and coordinated disclosure practices, and follows several other Windows flaws the researcher has publicly exposed, including **BlueHammer**, **RedSun**, **UnDefend**, **GreenPlasma**, and **YellowKey**.
Jul 13, 2026
Security researchers disclosed **RoguePlanet** and **RedSun**, two Windows local privilege escalation exploits that abuse Microsoft Defender workflows to elevate a standard user to `NT AUTHORITY\SYSTEM` on fully patched Windows systems. RoguePlanet weaponizes Defender’s quarantine pipeline through a design-level race condition involving **NTFS junctions**, **opportunistic locks**, **Volume Shadow Copy**, and the Windows Error Reporting `QueueReporting` scheduled task, while RedSun abuses Defender’s SYSTEM-privileged real-time scanning path with **Cloud Files API placeholders**, batch oplocks, and junctions to redirect privileged writes into `C:\Windows\System32`. Reports said the techniques rely on architectural interactions among legitimate Windows components rather than memory corruption or kernel bugs, making them harder to address with traditional exploit mitigations. RoguePlanet was publicly released by a researcher linked to the **Nightmare-Eclipse** toolset and was reproduced on Windows 11, with one report saying it had no patch or CVE at disclosure and another identifying it as **`CVE-2026-50656`** and stating it was already under active exploitation on Windows 10 and 11. Microsoft Defender reportedly detects a specific RoguePlanet sample as `Exploit:Win32/DfndrRugPlnt.BB`, but researchers said the exploit can remain effective after minor source changes and may succeed reliably on some hardware. RedSun was described as part of a broader offensive toolkit with **BlueHammer** and **UnDefend**; BlueHammer was patched as **`CVE-2026-33825`**, while RedSun and UnDefend were reported as unpatched and active, prompting recommendations to monitor `MsMpEng.exe`, restrict local access, and reduce SMB exposure until fixes are available.
Jul 12, 2026
Microsoft patched two actively exploited vulnerabilities in Microsoft Defender and related protection components, including **CVE-2026-41091**, a high-severity local privilege escalation flaw that can give an attacker **`NT AUTHORITY\SYSTEM`** privileges, and **CVE-2026-45498**, a medium-severity denial-of-service issue that can make Defender unavailable. The affected products include Microsoft Malware Protection Engine version **1.1.26030.3008 and earlier** and Microsoft Defender Antimalware Platform version **4.18.26030.3011 and earlier**, and both CVEs were added to CISA’s **Known Exploited Vulnerabilities** catalog due to active exploitation in the wild. Technical analysis of **CVE-2026-41091**, dubbed **RedSun**, says the bug lies in Windows Defender’s file remediation workflow when it processes malicious files marked as Cloud Files placeholders. A standard user can abuse Defender’s SYSTEM-level file operations, together with **NTFS junctions** and **oplocks**, to redirect a privileged write into **`C:\Windows\System32`**, plant a malicious binary such as **`TieringEngineService.exe`**, and then trigger execution through Storage Tiers Management COM activation to obtain a SYSTEM shell. Microsoft said the issues were fixed through automatic updates and urged organizations that disable auto-updates to manually update Defender and any products using the same engine and platform components.
Jul 24, 2026