Microsoft Defender Malware Protection Engine race-condition EoP ('RoguePlanet')
Race-condition EoP in the Microsoft Malware Protection Engine (Defender) that lets a local user reach SYSTEM. Fixed in engine build 1.1.26060.3008. Public PoC.
- Vendor
- Microsoft
- Product
- Microsoft Malware Protection Engine (versions 1.1.0.0 through 1.1.26060.3008 — shipped with Microsoft Defender on Windows 10, Windows 11, Windows Server, and Microsoft Defender for Endpoint on Server)
- CVSS
- 7.8
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
Is CVE-2026-50656 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-50656 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-22 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
CVE-2026-50656 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-50656, publicly named RoguePlanet, is a race condition in the Microsoft Malware Protection Engine — the shared component that runs Defender’s real-time scans on Windows 10, Windows 11, and Windows Server. Under normal operation a scan runs as SYSTEM against files the engine picks up from disk; the race window lets a local unprivileged user get an attacker-controlled action fired as SYSTEM, producing code execution as SYSTEM from a low-privileged account.
Microsoft published the advisory on 2026-07-09 and shipped the fix in Malware Protection Engine build 1.1.26060.3008. Anything from 1.1.0.0 through 1.1.26060.3008 is vulnerable per NVD’s product entry. The engine updates on Microsoft’s automatic Defender definition channel and should reach most fleets within 24-48 hours of publish; hosts that are behind on Windows Update, air-gapped, or pinned to non-default definition sources are where this lingers.
Microsoft’s CNA rates the flaw CVSS 7.8 (high) with vector
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. NVD’s independent scoring is
CVSS 7.0 (high), differing only on attack complexity. Either way
it is a serious local privilege escalation, not a remote one.
The researcher who disclosed it, working under the handle “Nightmare Eclipse,” published a proof-of-concept in a public Git repository at disclosure — NVD’s reference to the repo carries the “Product” tag. Microsoft’s advisory does not currently mark exploitation as detected in the wild, and CISA has not added CVE-2026-50656 to KEV as of publication.
See the full write-up for verification steps and fleet-prioritization guidance.
Other Microsoft CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 1.5% | |
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 0.5% | — |
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 2.1% | |
| CVE-2026-85889 Azure AI Foundry missing authentication allows unauthorized privilege escalationwrite-up | [ CRITICAL ] | 10.0 | 0.7% | — |
| CVE-2026-69843 Microsoft Fabric authentication bypass by spoofingwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 3.6% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-62916 Authentication Bypass via Alternate Path in Microsoft Entra IDwrite-up | [ CRITICAL ] | 9.1 | 0.9% | — |
