Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656)
ID: 2d40fc8a-0adb-5fdd-bb90-8d9d0f9babb5
STIX ID: report--2d40fc8a-0adb-5fdd-bb90-8d9d0f9babb5
Feed Name: Help Net Security
**RoguePlanet (CVE-2026-50656)**: A publicly released proof-of-concept by a researcher known as Nightmare Eclipse abuses a race condition in Microsoft Defender to achieve SYSTEM-level local privilege escalation on fully patched Windows 10/11 systems. Microsoft has acknowledged the issue, labeled it as "Exploitation More Likely", is preparing a security update, and reports no confirmed in-the-wild exploitation to date; the PoC may be unreliable due to timing/race conditions but works in tests and can bypass typical signature mitigations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
