A week ago, the security researcher who goes by “Nightmare Eclipse” published information about RoguePlanet, a zero-day security vulnerability in Microsoft’s Defender security program. The vulnerability, officially designated CVE-2026-50656, can be exploited by hackers to gain complete access to your computer.
The vulnerability exists in fully patched Windows 10 and Windows 11 devices and allows attackers to generate command prompts with system privileges via a race condition in Microsoft Defender. The security expert published a proof-of-concept exploit in a self-hosted Git repository and claimed that Microsoft had previously targeted and removed its exploit-hosting repositories on GitHub and GitLab.
The security expert writes: “The exploit is a race condition, so it’s a hit or miss. I have managed to get a 100% success rate on some machines while it struggled to work on others.”
In a statement to BleepingComputer, a Microsoft spokesperson explained that the company is working on developing a security patch for RoguePlanet, which will hopefully be released to the public soon:
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as ‘RoguePlanet.’
We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the update is available.
Recently, the same security researcher has published information about a whole range of security vulnerabilities in Windows and its related software, including BlueHammer, RedSun, MiniPlasma, and YellowKey.
Related posts:
Windows Security vs. Microsoft Defender: Important differences you should know
Microsoft fixes zero-day security flaw in latest Windows update
Windows Security vs. Microsoft Defender: Differences you should know
Security expert details how a simple Microsoft tool led to the discovery of a serious macOS flaw