A security researcher published a new Windows zero-day exploit that can give an attacker full SYSTEM privileges on fully patched consumer PCs. The proof-of-concept, dubbed RoguePlanet, abuses a race condition in Microsoft Defender to achieve local privilege escalation on Windows 10 and Windows 11 systems with June 2026 updates installed; the researcher says earlier versions also enabled remote code execution through malicious .vhd(x) files on remote SMB shares and BitLocker bypass paths, but the currently released exploit is validated primarily as local escalation and reportedly does not yet work on Windows Server.
Ionut Arghire
2026.06.17
96% relevant
This article updates the same RoguePlanet event with Microsoft's official acknowledgment, the assigned CVE-2026-50656 identifier, advisory details, and confirmation that a security update is being developed for the publicly released exploit affecting Microsoft Defender on Windows 10 and 11.
Sergiu Gatlan
2026.06.17
96% relevant
This directly updates the same RoguePlanet event by adding Microsoft's response: the flaw is now tracked as CVE-2026-50656, affects the Microsoft Malware Protection Engine in Defender, and Microsoft says it is working on a security update.
Ionut Arghire
2026.06.11
72% relevant
This source is a direct follow-on in the same Nightmare Eclipse disclosure spree, adding that one day after RoguePlanet the researcher released 'GreatXML', a separate Windows zero-day that abuses Microsoft Defender Offline scan and WinRE to bypass BitLocker and obtain a SYSTEM shell.
2026.06.10
99% relevant
This article is directly about the same newly disclosed RoguePlanet Windows Defender zero-day, adding that The Register reports Microsoft is investigating the claim, that the bug targets Microsoft Defender on fully patched Windows 10 and 11 systems, and that Nightmare Eclipse released PoC exploit code after June Patch Tuesday.
Ionut Arghire
2026.06.10
100% relevant
The article establishes a distinct new event: the public release and validation of a new, currently unpatched Microsoft Defender/Windows privilege-escalation exploit called RoguePlanet, separate from the previously tracked YellowKey and other Nightmare Eclipse disclosures.