CVE-2026-50656

Published Jun 16, 2026

Last updated 7 days ago

Zero-day

RoguePlanet

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-50656, publicly known as "RoguePlanet," is an elevation of privilege vulnerability found within the Microsoft Malware Protection Engine (MMPE), which serves as the core scanning component for Microsoft Defender. This flaw allows a local authenticated attacker to gain elevated privileges, specifically SYSTEM-level access, on a Windows machine by exploiting improper link resolution behavior during scanning and quarantine operations. The vulnerability is classified under CWE-59, indicating an issue with "Improper Link Resolution Before File Access (Link Following)," and involves a race condition that an attacker can leverage. Security researcher Nightmare Eclipse (also referred to as Chaotic Eclipse) discovered this vulnerability. Microsoft has acknowledged the issue and has since released a security update to address it. This update is automatically delivered through Defender platform updates, Windows Update, and WSUS to affected systems, which include Microsoft Defender Antivirus deployments utilizing MMPE on Windows endpoints and servers.

Description: Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".
Source: secure@microsoft.com
NVD status: Modified
Products: malware_protection_engine

Risk scores

CVSS 3.1

Type: Primary
Base score: 7
Impact score: 5.9
Exploitability score: 1
Vector string: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-59

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:malware_protection_engine:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "1CF44512-0B67-4B5F-B271-C8CA45D30DA8",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.