Microsoft developing patch for Defender RoguePlanet zero-day

Microsoft has formally acknowledged a serious security vulnerability in its Defender antivirus software and is working on a patch, one week after a security researcher publicly disclosed the flaw. The company published an advisory on Wednesday, June 17, 2026, confirming it is aware of the privilege escalation issue, which has been assigned the identifier CVE-2026-50656.

The vulnerability, publicly referred to as "RoguePlanet," was disclosed by a researcher using the alias Nightmare Eclipse, also known as Chaotic Eclipse. The researcher released a proof-of-concept exploit last week, coinciding with Microsoft's June 2026 Patch Tuesday updates. The exploit targets a race condition within the Microsoft Malware Protection Engine, allowing an authenticated attacker to gain SYSTEM-level privileges on a compromised system. According to the researcher, the flaw affects fully patched Windows 10 and Windows 11 systems.

In an update this week, Nightmare Eclipse noted that the proof-of-concept works regardless of whether Defender's real-time protection is enabled or disabled, and may even function when the software is in passive mode. The researcher acknowledged the exploit's success can be...