Microsoft shipped an out-of-band patch on July 8, 2026, closing “RoguePlanet” (CVE-2026-50656), an elevation-of-privilege flaw in Windows Defender’s Malware Protection Engine. The fix closes the seventh Windows zero-day Nightmare-Eclipse has publicly disclosed since April amid an escalating feud with Microsoft.
Quick Summary – TLDR:
- CVE-2026-50656 carries a 7.8 base CVSS score, rated Important severity, and needs only local access with low privileges to exploit.
- Microsoft patched the flaw in Malware Protection Engine version 1.1.26060.3008; the last vulnerable build was 1.1.26050.11.
- Nightmare-Eclipse’s exploit uses a race condition to spawn a SYSTEM-privileged command prompt, a technique the researcher said hit 100% success on some machines.
- Qualys claimed RoguePlanet had been “exploited in attacks,” while Microsoft’s advisory and the CISA KEV catalog show no confirmed exploitation.
- RoguePlanet is the seventh Windows zero-day disclosed since April, part of an ongoing Security Response Center dispute.
What Happened?
The revision dated July 8, 2026 on Microsoft’s advisory for CVE-2026-50656 confirms the engine update that fixed the flaw, according to Microsoft’s own update log. The company issued it as an out-of-band patch rather than through its usual monthly cycle.
The bug is tracked under CWE-59, Improper Link Resolution Before File Access. Attack complexity and privileges required are rated low, with no user interaction needed and high confidentiality, integrity, and availability impact once triggered. That combination is why exploitation is rated “More Likely,” per MSRC’s assessment, despite no confirmed attacks.
The exploit is a race condition, “hit or miss,” but capable of a 100% success rate on some machines regardless of whether Defender’s real-time protection was enabled, per Nightmare-Eclipse’s own account.
Microsoft has released security updates for a Defender vulnerability known as RoguePlanet, nearly a month after details of the flaw became public.
— Offensive Lab (@OffensiveLab) July 9, 2026
The vulnerability, tracked as CVE-2026-50656 (CVSS score: 7.8), is a privilege escalation issue in the Microsoft Malware Protection… pic.twitter.com/AuaW7CgIVx
A Flaw Inside the Security Tool Itself
RoguePlanet is not a remote-entry bug. The flaw requires local access to a device before exploitation, making it a post-compromise privilege escalation tool rather than something an attacker can trigger from outside a network. That distinction matters more than the CVSS number alone suggests: a flaw inside the security product itself is disproportionately valuable to an attacker who already has a foothold, because it can be turned against the very tooling meant to catch them.
SOCRadar’s research team wrote that RoguePlanet “is not remotely exploitable by itself, but it can be highly valuable after an attacker gains local code execution as a standard user.” Endpoint security products such as Microsoft Defender are deployed across millions of systems, making them attractive targets, but successful exploitation often leaves very limited public visibility, SOCRadar CISO Ensar Seker told Dark Reading, noting attackers who disable or evade security controls have a strong incentive to stay quiet.
Conflicting Signals on Exploitation
Microsoft’s updated advisory states the vulnerability has not been exploited, and CISA has not added CVE-2026-50656 to its Known Exploited Vulnerabilities catalog. Qualys published a threat report on June 18 stating RoguePlanet had been “exploited in attacks,” though it provided no supporting details. That gap between MSRC’s “no confirmed exploitation” and a named vendor’s “exploited in attacks” is not necessarily a contradiction, and it is where the story gets more interesting than a routine patch note.
Seker told Dark Reading it is unusual for Microsoft to issue an emergency update shortly before a Patch Tuesday release, and attributed the timing to increased urgency around the flaw.
The Disclosure Feud Behind the Patch
The dispute traces back to April, when Nightmare Eclipse published an exploit for a separate Defender flaw and has since accused Microsoft of ignoring vulnerability reports, deleting submission accounts, and treating independent researchers with contempt. The researcher, who claims to be a former Microsoft employee, dubbed that earlier flaw BlueHammer (CVE-2026-33825) and disclosed it out of frustration with Microsoft’s Security Response Center.
Nightmare Eclipse alleged Microsoft removed RoguePlanet proof-of-concept repositories from GitHub and GitLab before the exploit was relocated to a self-hosted site. After initially warning that publishing exploit code could carry legal consequences, Microsoft issued a clarification saying it had no intention of pursuing action against researchers conducting or publishing legitimate security work.
SQ Magazine’s Takeaway
RoguePlanet reads less like a single closed vulnerability and more like the final chapter of a disclosure relationship that stopped functioning months earlier. Seven zero-days from one researcher against one vendor’s flagship security product, released outside coordinated timelines, is the direct cost of a bug-bounty process both sides describe as adversarial rather than collaborative. The conflicting exploitation signals deserve more weight than a routine “patched, move on” framing gives them: a named vendor claiming in-the-wild abuse against an MSRC “not exploited” assessment, with no KEV entry either way, is exactly the visibility gap Seker describes.
Security teams should confirm the Malware Protection Engine has already updated past version 1.1.26050.11, since Microsoft’s default configuration applies engine and definition updates automatically. Systems with Defender disabled are not in an exploitable state even though scanners may still flag the on-disk binaries.
Because RoguePlanet only matters after an attacker already has local code execution, the practical monitoring targets are user-context processes spawning SYSTEM-level shells, unexpected Defender service or configuration changes, and new scheduled tasks tied to security-tooling processes. Microsoft’s next cumulative update likely bundles further hardening rather than a second emergency fix for this engine bug, though Nightmare-Eclipse’s pattern suggests another disclosure could surface before then.
