Microsoft Defender zero-day RoguePlanet grants SYSTEM privileges

On June 9, 2026, researcher/author "Nightmare Eclipse" published a proof-of-concept named RoguePlanet: an unpatched Windows zero-day local privilege escalation affecting Windows 10 and 11. RoguePlanet leverages Windows Defender remediation, a crafted ISO mounted without a drive letter, shadow copy detection, NTFS reparse points and oplock race conditions to overwrite C:\Windows\System32\wermgr.exe and trigger the \Microsoft\Windows\Windows Error Reporting\QueueReporting scheduled task to execute the payload with SYSTEM privileges; the report includes code analysis, IOCs (APIs, file paths, pipe, DLLs, embedded strings) and mitigations emphasizing application allowlisting and monitoring of atypical file movements into trusted Windows directories.