Microsoft Defender RoguePlanet Grants SYSTEM Access

A security researcher has released a new exploit for a previously undisclosed vulnerability in Microsoft Defender, marking the latest escalation in a public dispute over vulnerability disclosure practices. The researcher, who uses the online alias Nightmare Eclipse, also known as Chaotic Eclipse, published proof-of-concept code for the flaw, dubbed "RoguePlanet," on June 9, 2026.

The exploit targets a race condition vulnerability within Microsoft Defender. If successful, it can spawn a command shell with SYSTEM-level privileges, granting an attacker the highest possible permissions on a compromised Windows machine. According to the researcher, the exploit has been tested and works on fully updated Windows 10 and Windows 11 systems, including those with the June 2026 Patch Tuesday updates installed. A cybersecurity firm, ThreatLocker, confirmed it successfully reproduced the exploit on a patched Windows 11 system.

The current version of the exploit does not function on Windows Server installations because standard users cannot mount ISO images, a required step in this specific attack chain. However, the researcher asserts that the underlying vulnerability still affects server...