Chaotic Eclipse released a PoC for ShieldBreak, a Microsoft Defender zero-day that bypasses the CVE-2026-50656 patch and could enable SYSTEM-level code execution.
Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a PoC for ShieldBreak, a Microsoft Defender zero-day. The flaw bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition that can allow attackers to spawn a SYSTEM-level shell. Successful exploitation could enable arbitrary code execution and other unauthorized actions on affected Windows systems.
“Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass.” said Chaotic Eclipse. “The PoC was tested in the latest version of windows 11 25h2 (+Canary channel) and windows server 2025, the PoC also have a 100% success rate. Please note that Windows 10 (and respective server editions) are not currently supported, they are however vulnerable to ShieldBreak as well.”
In early July, Microsoft released security updates for RoguePlanet, a vulnerability tracked as CVE-2026-50656 (CVSS score of 7.8) affecting the Malware Protection Engine used by Defender. The Microsoft Malware Protection Engine (mpengine.dll) powers Defender’s malware scanning, detection, and removal functions.
The flaw is a local privilege escalation issue that could allow an attacker with access to a system to obtain higher privileges and potentially compromise security controls.
In mid-June, Microsoft acknowledged the RoguePlanet zero-day affecting Microsoft Defender and stated it is aware of the issue and was actively developing a security update to address the flaw and protect affected systems.
A week before, the security researcher Chaotic Eclipse published a new proof-of-concept exploit for a RoguePlanet. The flaw relies on a race condition that can provide attackers with SYSTEM-level privileges, allowing them to execute code with the highest permissions. The exploit was successfully tested on fully updated Windows 10 and Windows 11 systems running the June 2026 Patch Tuesday updates, showing that patched systems may still be vulnerable.
Now Chaotic Eclipse claims ShieldBreak fully bypasses Microsoft’s CVE-2026-50656 patch, while Defender may also leak 8 bytes of data under certain conditions.
The researcher tested the PoC on Windows 11 25H2 and Windows Server 2025 with a 100% success rate. Windows 10 is also vulnerable, though not currently supported by the PoC.
In May, the researcher disclosed two other Windows zero-day vulnerabilities named YellowKey and GreenPlasma. The flaws affect BitLocker and the Windows Collaborative Translation Framework (CTFMON). YellowKey could allow attackers to bypass BitLocker protections, while GreenPlasma enables privilege escalation. The researcher previously disclosed three Microsoft Defender vulnerabilities.
The researcher criticized Microsoft for revoking access to their MSRC account, rejecting reports, and failing to provide compensation.
At the end of May, Microsoft’s Security Response Center called the zero-day dumps irresponsible.
“In recent weeks several zero-day vulnerabilities have been publicly disclosed.” reads the report published by Microsoft. “The details of these vulnerabilities were not shared with Microsoft prior to release, and the disclosures put our customers at unnecessary risk.”
The company said its security teams have been working around the clock since the disclosures to understand the impact, build patches, and protect customers from attackers who picked up the published exploit code and ran with it.
Microsoft’s post is essentially a public defense of Coordinated Vulnerability Disclosure, the standard practice where a researcher notifies a vendor privately, gives them time to fix the issue, and then goes public. Microsoft says it works with hundreds of researchers this way every year, compensating them through bug bounty programs and crediting them publicly.
“This partnership allows us to make updates to impacted services before proof-of-concept code can make it into the hands of bad actors.” continues the report. “The vulnerabilities known as RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma were not responsibly disclosed.”
The implication is clear: when someone skips that step, real people get attacked with real tools built from the published research.
In July, just hours after Microsoft’s July 2026 Patch Tuesday, Chaotic Eclipse, published a new Windows zero-day proof-of-concept called LegacyHive. This time, the target is the Windows User Profile Service (ProfSvc), and unlike the hundreds of vulnerabilities Microsoft fixed this month, this one currently has no CVE, no advisory, and no security update.
LegacyHive is a local privilege escalation vulnerability. An attacker who already has code execution as a standard user can abuse the User Profile Service to load another user’s registry hive, potentially that of a local administrator, under their own profile.
At the end of May, Microsoft’s Security Response Center called the zero-day dumps irresponsible.
“In recent weeks several zero-day vulnerabilities have been publicly disclosed.” reads the report published by Microsoft. “The details of these vulnerabilities were not shared with Microsoft prior to release, and the disclosures put our customers at unnecessary risk.”
The company said its security teams have been working around the clock since the disclosures to understand the impact, build patches, and protect customers from attackers who picked up the published exploit code and ran with it.
Microsoft’s post is essentially a public defense of Coordinated Vulnerability Disclosure, the standard practice where a researcher notifies a vendor privately, gives them time to fix the issue, and then goes public. Microsoft says it works with hundreds of researchers this way every year, compensating them through bug bounty programs and crediting them publicly.
“This partnership allows us to make updates to impacted services before proof-of-concept code can make it into the hands of bad actors.” continues the report. “The vulnerabilities known as RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma were not responsibly disclosed.”
The implication is clear: when someone skips that step, real people get attacked with real tools built from the published research.
Microsoft fixed RoguePlanet (CVE-2026-50656), a Defender flaw allowing local attackers to gain higher privileges through the Malware Protection Engine.
Microsoft released security updates for RoguePlanet, a vulnerability tracked as CVE-2026-50656 (CVSS score of 7.8) affecting the Malware Protection Engine used by Defender. The Microsoft Malware Protection Engine (mpengine.dll) powers Defender’s malware scanning, detection, and removal functions.
The flaw is a local privilege escalation issue that could allow an attacker with access to a system to obtain higher privileges and potentially compromise security controls.
In mid-June, Microsoft acknowledged the RoguePlanet zero-day affecting Microsoft Defender and stated it is aware of the issue and was actively developing a security update to address the flaw and protect affected systems.
A week before, the security researcher Chaotic Eclipse, also known as Nightmare-Eclipse, published a new proof-of-concept exploit for a RoguePlanet Microsoft Defender zero-day.
The flaw relies on a race condition that can provide attackers with SYSTEM-level privileges, allowing them to execute code with the highest permissions. The exploit was successfully tested on fully updated Windows 10 and Windows 11 systems running the June 2026 Patch Tuesday updates, showing that patched systems may still be vulnerable.
“Yes the rumors were true, a zero day vulnerability will be dropped this month as well
https://github.com/MSNightmare/RoguePlane” wrote the researcher. “As mentioned in the repo, it’s a race condition, I managed to stabilize it as much as I can but writing this PoC geniunely drained my soul.”
The researcher said he spent weeks working almost continuously to develop a working RoguePlanet exploit after Microsoft updates initially broke the prototype. Despite Microsoft’s efforts to strengthen Defender against path redirection attacks, he claimed to have restored the PoC by the end of May. The researcher also alleged that Microsoft Defender remains vulnerable and claimed to have discovered additional memory corruption flaws and other security issues affecting multiple components.
The RoguePlanet exploit currently does not work on Windows Server because standard users cannot mount ISO images, although the researcher claims the underlying vulnerability still affects server installations and only requires a different exploitation method.
“The race condition part is a bit interesting, I believe (but not sure) that a redesign of the PoC can make it achieve a 100% success rate regardless of the conditions but honestly I’m done with this bug. If the exploit succeeds, a SYSTEM shell will be spawned” continues the researcher.
In an update published by the researcher, he claimed the RoguePlanet PoC worked even with Microsoft Defender real-time protection disabled or enabled, and likely in passive mode too.
“I forgot to add one thing, surprisingly, the PoC for RoguePlanet works regardless if real-time protection is on or not, which is hilarious. I think it even works in the case of passive mode, but not really sure, haven’t tested that.” wrote the expert.
The issue was fixed in Microsoft Malware Protection Engine version 1.1.26060.3008, which also includes additional security hardening updates.
“For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.” reads the advisory. “Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.”
RoguePlanet is the fourth Defender flaw reported by the researcher, following BlueHammer, UnDefend, and RedSun, all already fixed by Microsoft.
Microsoft issued a security update that fixes the zero-day vulnerability known as RoguePlanet in Microsoft Defender.
RoguePlanet is tracked as CVE-2026-50656, a Microsoft Defender elevation of privilege (EoP) vulnerability. As we reported last month, if successfully exploited, RoguePlanet can allow an attacker to elevate privileges from a standard user account to NT AUTHORITY\SYSTEM, the highest privilege level on Windows.
This means an attacker who gains access to a standard user account on your computer could use the vulnerability to take complete control of the system. They don’t need advanced hacking skills or administrator permissions to do this.
If Windows Security shows that another antivirus, such as Malwarebytes, is protecting your PC and Microsoft Defender Antivirus is turned off (as shown below), this particular vulnerability does not affect your system. Defender’s scanning engine isn’t running, so it can’t be exploited through this flaw.
If you’re running another antivirus and Defender is turned off, there’s nothing to worry about
Most users are already protected
By default, Microsoft Defender automatically updates both its malware definitions and the Microsoft Malware Protection Engine.
But if you’re in any doubt, you can check the version of the Malware Protection Engine on your system. Here’s how:
Click the Start button, type Security, and choose Windows Security from the results.
Select Virus & threat protection, then under Virus & threat protection updates, click Check for updates.
Click Settings (the cog icon) then select About.
Look for a line called Engine Version. That number is the version of the Malware Protection Engine used by Microsoft Defender.
If your Engine Version is 1.1.26060.3008 or higher, your system has the patched (or newer) engine.
If your Engine Version is 1.1.26050.11 or lower, your system is still running a vulnerable engine. Run Windows Update and check for Defender updates again, or wait for the automatic update to complete.
Note: Version numbers are compared from left to right. For example, 1.1.26060.3008 is newer than 1.1.26050.11 because 26060 is higher than 26050.
If you use Windows Defender, leave automatic updates turned on. The Malware Protection Engine normally updates automatically, so most home users will receive the fix without doing anything. These steps are simply a way to double-check your system has the updated engine.
We don’t just report on threats—we remove them
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
A publicly available exploit called RoguePlanet can give attackers the highest level of access on Windows systems. Microsoft has confirmed the vulnerability and says it’s working on a security update.
RoguePlanet is tracked under CVE-2026-50656, where it’s described as a Microsoft Defender Elevation of Privilege (EoP) vulnerability.
In its advisory, Microsoft says:
“Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as “RoguePlanet “. We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the update is available.”
If successfully exploited, RoguePlanet can allow an attacker to elevate privileges from a standard user account to NT AUTHORITY\SYSTEM, the highest privilege level on Windows.
This means an attacker who manages to get access to a standard user account on your computer could use the vulnerability to gain complete control of the system. They don’t need advanced hacking skills or administrator permission to do this.
The success of the published exploit does depend on a race condition, though. This means its success depends on the precise timing of two events. The researcher wrote:
“I have managed to get a 100% success rate on some machines while it struggled to work on others.”
It seems that the problem lies in a high-level part of the Microsoft Defender code, which may help to explain why Microsoft says it’s working on a “high quality security update.”
This same researcher has submitted three earlier Microsoft Defender vulnerabilities known as BlueHammer (CVE-2026-33825), UnDefend (CVE-2026-45498), and RedSun (CVE-2026-41091), as well as four other Windows zero-days, all of which have since been patched by Microsoft.
How to protect your machine
The exploit reportedly works whether you’re using active protection or not, so disabling Microsoft Defender is not a solution. But there are a few things you can do to protect your machine:
Look out for a Microsoft security update addressing this vulnerability and install it as soon as it becomes available.
Back up your important data on a platform or device that is not directly connected to your computer.
Be careful about downloading executable files from unknown sources or running files that are recommended to you without you asking for them.
Do not rely on Microsoft Defender as your only anti-malware solution. Malwarebytes detects RoguePlanet.exe (the exploit code) based on its behavior.
Obviously, we’ll keep you posted about this and other security issues, so stay tuned.
“One of the best cybersecurity suites on the planet.”
A newly disclosed Windows Defender vulnerability, tracked as CVE-2026-50656 and dubbed RoguePlanet, has raised concerns across the cybersecurity community after a working proof-of-concept (PoC) exploit was released before a security patch became available. The exploit was published on GitHub by security researcher Nightmare Eclipse on June 10, 2026, only hours after Microsoft issued its June Patch Tuesday updates.The RoguePlanet flaw affects Microsoft Defender and carries a CVSS 3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). It is categorized under CWE-362, which covers race conditions caused by improper synchronization of shared resources. Microsoft has acknowledged CVE-2026-50656 and confirmed that a fix is in development, but as of June 18, 2026, the company has not announced a release timeline.
Nightmare Eclipse Releases RoguePlanet After Previous Disclosures
The publication of CVE-2026-50656 followed the researcher’s earlier coordinated disclosures involving two other Defender vulnerabilities, CVE-2026-45586 (GreenPlasma) and CVE-2026-45585 (YellowKey), both of which were addressed during June’s Patch Tuesday cycle.According to Nightmare Eclipse, the decision to publicly release RoguePlanet without a prior coordinated disclosure period stemmed from dissatisfaction with what the researcher described as slow response times within Microsoft’s bug bounty process. As a result, defenders are now dealing with a publicly documented exploit targeting one of the world’s most widely deployed endpoint security platforms before a patch is available.
How CVE-2026-50656 Works
At its core, CVE-2026-50656 exploits a Time-of-Check to Time-of-Use (TOCTOU) race condition inside Microsoft Defender’s file-processing workflow. During a scan, Defender checks a file path and later reopens the file for analysis. The RoguePlanet exploit takes advantage of the gap between those two actions by replacing the original file with a malicious payload.Because Microsoft Defender operates under the SYSTEM account, a successful race condition allows the substituted payload to execute with SYSTEM-level privileges. The exploit reportedly works on fully patched Windows 10 and Windows 11 systems.Although exploitation requires local authenticated access, attackers often obtain such access through phishing campaigns, browser exploits, or stolen credentials. The PoC is not guaranteed to succeed on every attempt because it depends on winning the race condition. However, Nightmare Eclipse noted that automated retry mechanisms can make exploitation reliable in practical scenarios.
Why RoguePlanet Matters
Local privilege escalation vulnerabilities such as CVE-2026-50656 are frequently used in post-compromise attack chains. Once attackers gain limited access, vulnerabilities like RoguePlanet can elevate permissions to full system control. This enables actions such as disabling security software, extracting credentials from LSASS, establishing persistence, and moving laterally across networks.Microsoft stated that it is working on a “high-quality patch” but has not committed to an out-of-band release, leaving open the possibility that CVE-2026-50656 could remain unpatched until a future Patch Tuesday update.Organizations are advised to monitor Windows Event Logs for unexpected SYSTEM-level process creation, deploy EDR detections for rapid file-substitution activity, enforce least-privilege access controls, restrict unnecessary development tools, enable Attack Surface Reduction rules in block mode, block known PoC hashes, and deploy Microsoft’s fix immediately once it becomes available.
Entrar
