Loading vulnerability…
RoguePlanet is an elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender. Public reporting describes the flaw as affecting the engine component mpengine.dll and allowing a local low-privilege user to obtain NT AUTHORITY\SYSTEM privileges. The issue is attributed to a race condition combined with improper link resolution during file access, causing the engine to follow attacker-influenced links in a privileged context. Microsoft characterizes the issue as an elevation-of-privilege flaw in the Microsoft Malware Protection Engine and advisory material identifies the weakness as improper link resolution before file access.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository is a Windows-focused local exploit PoC for CVE-2026-50656, described as a Microsoft Defender patch bypass ('ShieldBreak'). The repo is small and centered around a single substantial C++ source file, ShieldBreak-MSNightmare/ShieldBreak.cpp, plus Visual Studio project files, a resource header, and documentation. The top-level README mainly wraps and references the upstream ShieldBreak project, while the nested ShieldBreak-MSNightmare directory contains the actual exploit implementation. The exploit is not a framework module and appears to be a standalone Visual Studio C++ application. Its code imports numerous Windows-specific APIs and libraries including ntdll, Cloud Files API (cfapi), COM/OLE, ACL APIs, and Task Scheduler interfaces. The visible code shows embedded resources for a ZIP and DLL, suggesting the executable carries staged artifacts internally. Project metadata further references eicar_com.zip, Report.wer, ShellDll.dll, and Warden.dll, indicating the exploit likely uses a Defender-detectable sample plus one or more DLL payloads and a crafted WER report. Operationally, the exploit appears to be a local attack chain rather than a remote/network exploit. It creates files and directories, interacts with Cloud Files sync-root functionality, sets up a named pipe for synchronization, and uses COM to connect to the Windows Task Scheduler service. It specifically opens the task folder '\Microsoft\Windows\Windows Error Reporting', retrieves the 'QueueReporting' task, and runs it. This strongly suggests the exploit abuses Windows Error Reporting task execution as part of the bypass chain. After successful execution it prints '[+] Exploit succeeded.' and performs cleanup by disconnecting/unregistering the sync root and deleting staged files/directories. No external network C2, hardcoded IPs, or remote URLs are present in the exploit code shown. The notable fingerprintable targets are local Windows components: the Windows Error Reporting scheduled task path, temporary/staged files, embedded DLL/ZIP resources, and named-pipe-based IPC. Overall, this is a real exploit PoC with embedded payload/staging capability, intended to demonstrate a local Defender bypass on modern Windows systems rather than merely detect the vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
236 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An earlier Microsoft Defender privilege-escalation vulnerability whose patch is described in the article as being bypassed by ShieldBreak.
A Microsoft Defender / Microsoft Malware Protection Engine privilege-escalation vulnerability previously addressed by Microsoft; ShieldBreak is described as bypassing protections introduced for it.
Privilege escalation vulnerability in Microsoft Defender caused by a race condition; allowed SYSTEM privileges and arbitrary code execution on fully updated Windows 10 and Windows 11 systems.
A previously patched Windows Defender-related vulnerability referred to as RoguePlanet, mentioned here because a new zero-day called ShieldBreak reportedly bypasses its July patch.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.