RoguePlanet Defender Zero-Day Has 100% Exploit Success on Some Windows Machines

For security operations teams, a working local privilege escalation exploit that can hit a 100% success rate on some machines instantly raises the priority level of every unpatched Windows endpoint. The RoguePlanet vulnerability threatens to undermine the trust in Microsoft Defender's engine, which many organizations depend on as a baseline security layer. As the researcher's feud with Microsoft intensifies, defenders can expect more aggressive zero-day releases with limited vendor coordination.

Microsoft has confirmed a zero-day vulnerability in its Defender antivirus engine that allows attackers to gain SYSTEM privileges on fully patched Windows machines, underscoring a tense standoff with a security researcher who publicly disclosed the flaw with a working exploit. The bug, tracked as CVE-2026-50656 with a CVSS score of 7.8, was detailed one week earlier by researcher Nightmare Eclipse, who published a proof-of-concept named 'RoguePlanet' targeting a race condition in the Microsoft Malware Protection Engine. The disclosure is the latest in an escalating series of zero-days dropped by the researcher, who has expressed deep frustration with Microsoft's handling of vulnerability reports.

“

The bug, tracked as CVE-2026-50656 with a CVSS score of 7.8, was detailed one week earlier by researcher Nightmare Eclipse, who published a proof-of-concept named 'RoguePlanet' targeting a race condition in the Microsoft Malware Protection Engine.

The vulnerability is particularly concerning because the exploit works regardless of whether Defender's real-time protection is enabled, and even in passive mode on some configurations. The PoC was demonstrated on Windows 10 and Windows 11 systems running the June 2026 patches, meaning the attack surface is vast for any organization reliant on Microsoft's built-in security. While the race condition makes the exploit unreliable in some cases, Nightmare Eclipse reported achieving a 100% success rate on certain machines, raising the stakes for attackers who could weaponize the bug in targeted intrusions or malware campaigns.

Microsoft published a brief advisory on June 16, acknowledging the elevation-of-privilege issue and stating it is 'working to provide a high-quality security update.' The company did not attribute the discovery to Nightmare Eclipse, a move that further inflamed the researcher's discontent over credit and transparency. The advisory did not specify a patch timeline, leaving defenders in a bind: a publicly available exploit exists, yet no official fix is available. Organizations must rely on workarounds or heightened monitoring until Microsoft delivers a patch, possibly as part of an out-of-band update.

The RoguePlanet incident fits into a broader pattern. Earlier this year, the same researcher released multiple other zero-days—BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), and UnDefend (CVE-2026-45498)—some of which were reportedly exploited in the wild. The cascade of disclosures suggests systemic friction between independent researchers and Microsoft's security response team. Nightmare Eclipse has alleged their repositories hosting PoCs were removed from GitHub and GitLab, fueling the decision to self-host exploits and release them with limited vendor coordination.

From an industry perspective, the RoguePlanet vulnerability highlights the inherent risks of deep-kernel components like the Malware Protection Engine, which runs with elevated privileges and is exposed to untrusted input. Even though Microsoft closed prior exploitation paths for this bug in May, the researcher bypassed those mitigations, indicating a cat-and-mouse dynamic. The fact that the exploit functions with Defender's real-time protection turned off—owing to the engine's deep system integration—suggests that disabling the service is not a reliable stopgap measure.