2026-07-09 · view entry permalink →
CVE-2026-50656, Microsoft Defender engine 'RoguePlanet' local privilege escalation now patched; NCSC-CH tracks the ongoing 'Nightmare Eclipse' zero-day series
NCSC-CH's running tracker on the "Nightmare Eclipse" (aka Chaotic Eclipse) researcher's 2026 zero-day PoC series was updated on 2026-07-09 to record that a CVE has been assigned to RoguePlanet: CVE-2026-50656, a local privilege-escalation vulnerability (CWE-59, improper link resolution before file access / "link following") in the Microsoft Malware Protection Engine that underpins Microsoft Defender, System Center Endpoint Protection and Microsoft Security Essentials (NCSC-CH, 2026-07-09) (Microsoft MSRC, 2026-07-08). The researcher first disclosed RoguePlanet as an unpatched zero-day on 2026-06-09, Patch Tuesday, describing a race condition in Defender that lets a local attacker "execute arbitrary code or spawn a command shell with SYSTEM-level privileges", at which point NCSC-CH logged its status as "Proof of Concept Available, no patch available" (NCSC-CH, 2026-07-09). Microsoft's own record shows the CVE was published 2026-06-16 (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N, rated "Exploitation More Likely", exploitation status "No") and remained without a fix for over three weeks; a revision dated 2026-07-08 confirms Microsoft has now shipped an engine update that closes it, last vulnerable Malware Protection Engine build 1.1.26050.11, first fixed build 1.1.26060.3008 (Microsoft MSRC, 2026-07-08).
Because Microsoft applies engine and definition updates automatically by default, most estates will already carry the fixed build; Microsoft's guidance is that no manual action is normally required. Microsoft advises customers to verify that automatic deployment of engine updates is working as expected (Microsoft MSRC, 2026-07-08); in analyst judgement, that matters most where engine updates are pinned, WSUS-gated, air-gapped or centrally deferred, such as System Center Endpoint Protection deployments and offline or OT-adjacent Windows hosts. Microsoft also notes that hosts with Defender disabled are not in an exploitable state even though vulnerability scanners flag the on-disk binaries. NCSC-CH later recorded that a proof of concept dubbed ShieldBreak allegedly bypasses this fix; Microsoft tracks it as CVE-2026-69414 (NCSC-CH, 2026-07-09).
Microsoft has released an update to the Microsoft Malware Protection Engine that addresses the vulnerability identified by CVE-2026-50656.
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as
Neither Microsoft's advisory nor NCSC-CH's tracker describes the exploitation mechanism beyond link following and a race condition, so the earlier triage guidance on symlink races against scanned files and on the engine's child processes is withdrawn. NCSC-CH has since recorded that a proof of concept dubbed ShieldBreak allegedly bypasses this fix, tracked by Microsoft as CVE-2026-69414 (NCSC-CH, 2026-07-09); Microsoft lists engine 1.1.26080.3 as the first build that addresses it (Microsoft Security Response Center, CVE-2026-69414). The priority moves from notable to routine: the flaw is local and the engine fix installs automatically. A pinned estate should therefore verify that build rather than the RoguePlanet fix alone.
Builds on: Nightmare/Chaotic Eclipse zero-day wave; the Defender LPE now carries a CVE, a public PoC, and… · Microsoft has now shipped an engine fix (1.1.26080.3), and the same researcher claims a partial…