Reported by 1 outlet

Timeline

1. original reporting

   RoguePlanet (CVE-2026-50656) — Microsoft Assigns CVE, Working on Defender Patch One Week After Public Disclosure

   bleepingcomputer.com · 119d ago · June 17th, 2026

   Microsoft has confirmed it is working on a security patch for the RoguePlanet Microsoft Defender race condition zero-day, now tracked as CVE-2026-50656, one week after researcher Nightmare Eclipse publicly released an exploit granting SYSTEM privileges on fully patched Windows 10 and Windows 11. Microsoft's advisory acknowledges the vulnerability in the Microsoft Malware Protection Engine but does not credit the researcher — part of an ongoing dispute over Microsoft's bug bounty practices. The exploit triggers a race condition in Defender's internal processing to spawn a SYSTEM-level command prompt regardless of whether real-time protection is enabled. Nightmare Eclipse previously leaked BlueHammer, RedSun, GreenPlasma, MiniPlasma, YellowKey, and UnDefend exploits, with Microsoft fixing GreenPlasma, MiniPlasma, and YellowKey in the June Patch Tuesday.

   Hunting hypothesis: Monitor for unexpected cmd.exe or powershell.exe child processes spawned from MsMpEng.exe — the Defender engine process should never launch interactive shells.

   ---

2. update from bleepingcomputer.com

   CVE-2026-50656 "RoguePlanet": Microsoft Patches Defender Zero-Day After Researcher Public Dispute

   bleepingcomputer.com · 97d ago · July 9th, 2026

   Nightmare Eclipse has now disclosed a series of Defender zero-days — BlueHammer, RedSun, GreenPlasma, MiniPlasma, YellowKey, UnDefend, and now RoguePlanet — each accompanied by proof-of-concept exploits. Microsoft has also issued legal warnings against "malicious activity causing real harm to our customers," which the security community interpreted as threats directed at the researcher. The PoC exploit reportedly works regardless of real-time protection status, with variable success rates depending on the target machine. Recommended action: Verify Malware Protection Engine version is ≥1.1.26060.3008 across all Windows endpoints. Defender updates automatically, but verify via About Microsoft Defender Antivirus in the Windows Security app.