RoguePlanet: Microsoft Defender Race Condition Zero-Day Grants SYSTEM on Fully Patched Windows 10/11

Nightmare Eclipse published RoguePlanet within hours of the June 9, 2026 Patch Tuesday: a race condition in Microsoft Defender's internal processing that spawns a command prompt with SYSTEM privileges on fully patched Windows 10 and Windows 11. ThreatLocker validated it against a fully patched Windows 11 build with KB5094126 installed, so current patch level is the vulnerable configuration, not the safe one. The bug is a TOCTOU race in the same class as Nightmare Eclipse's earlier BlueHammer exploit, CVE-2026-33825, which Microsoft patched in April 2026. RoguePlanet began as remote code execution through malicious .vhd files on SMB shares, but Microsoft silently hardened the mpengine!SysIO* API in mid-May 2026, breaking the remote path and leaving local privilege escalation as the surviving vector. There is no CVE and no advisory for RoguePlanet, and this is the sixth public release in the researcher's protest series, after BlueHammer, RedSun, GreenPlasma, YellowKey, and MiniPlasma.

The exposure is close to universal by construction. Defender is the default antimalware on Windows desktops and servers, its engine runs as SYSTEM, and it reflexively parses file formats an attacker supplies, so a public, unpatched elevation primitive inside it converts any modest foothold, from a phished user to commodity malware, into SYSTEM without tripping a third-party agent. The dashboard effect is the argument for ranking this above the day's routine advisories: fleets with the best patch compliance, KB5094126 and equivalent June builds everywhere, are exactly the exposed ones, and remediation tracked by patch level produces false assurance. The timing is tactical as well as expressive, because releasing hours after Patch Tuesday buys roughly a month until the next scheduled fix, the longest window available, and it follows a mid-May hardening that proved Microsoft will change this code without public acknowledgment. Six releases deep, the series is built to make that silence expensive, and public code means any intrusion crew can adopt the primitive as a copy-paste step rather than a research project.

With no patch to deploy, the work is compensating controls and hunting. Application allowlisting blocks the exploit outright, since the payload ends in an interpreter spawn that a default-deny policy never permits, and hosts reporting KB5094126 should be treated as the exposure list rather than the clean list. In process creation telemetry, Sysmon EID 1 or Windows Security 4688, alert on cmd.exe whose parent is the Defender service process, because a shell child of the antimalware engine does not occur in normal operation and is the signature the exploit's stated effect produces. The original delivery path also gives a file-side hunt: .vhd files written to or scanned from SMB shares, which flagged Defender's parser before the mid-May hardening, deserve review in file and share audit logs even though the remote variant is believed broken.

Two developments would change the assessment. An out-of-band engine update, a CVE assignment, or a fix that lands in the July monthly rollup with no acknowledgment would settle whether the protest extracted a concession or was met with silence a sixth time. Operational adoption is the second: any telemetry of Defender-spawned shells outside lab conditions, or the technique surfacing inside commodity loaders or ransomware pre-encryption tooling, moves RoguePlanet from a disclosure weapon to an intrusion staple, at which point allowlisting and the parent-child alert stop being optional.