RoguePlanet (CVE-2026-50656): The Unpatched Microsoft Defender Zero-Day That Grants SYSTEM Access

• A low-privileged user creates a specially crafted symbolic link or file that the engine checks (Time-of-Check) and then swaps it before the engine uses it (Time-of-Use).
• By winning this race — using an oplock to reliably control timing — the attacker redirects the engine's file operation to an arbitrary location, such as a directory the attacker controls ^PT.
• The engine then performs a privileged file operation (e.g., writing or executing) at the attacker-chosen path, effectively spawning a command shell running with SYSTEM privileges ^KL.

The exploit is local — the attacker must already have standard user access to the machine — but requires no additional privileges beyond that ^C. It also works regardless of whether Defender's real-time protection is enabled or disabled ^MI.

CVSS Score and Severity

Microsoft assigns a CVSS 3.1 base score of 7.8 (HIGH), using Attack Complexity: Low (arguing the oplock makes the race reliable). NVD lists a base score of 7.0 (HIGH) with Attack Complexity: High (acknowledging the race difficulty). The temporal vector (E:F/RL:U/RC:C) yields a temporal score of 7.6 under Microsoft's assessment ^CLM.

The vulnerability is rated "Exploitation More Likely" on Microsoft's Exploitability Index ^KC.

Public Disclosure Timeline

The gap between public exploit release and Microsoft's acknowledgment was critical:

The gap between public exploit release (June 10) and Microsoft's acknowledgment (June 16) was ~6 days. As of early July 2026, the exploit has been public for roughly one month with no fix ^FT.

Who Discovered It: The Nightmare Eclipse Campaign

The vulnerability was discovered and publicly released by a security researcher operating under the aliases Nightmare Eclipse (also known as Chaotic Eclipse) ^CTH.

This is the seventh exploit in the researcher's ongoing campaign targeting Microsoft Defender. Previous disclosed Defender flaws included earlier privilege-escalation and bypass vulnerabilities such as BlueHammer, RedSun, UnDefend, YellowKey, and GreenPlasma ^PD. TechRadar characterizes RoguePlanet as part of "a sustained research campaign against the Defender attack surface" ^H. Validated PoC reproductions by third-party groups like ThreatLocker confirm the reliability of the exploit chain ^T.

Community Criticism of the Patch Delay

The prolonged patch gap drew sharp criticism from the security community:

• Red Hound described the situation bluntly: "A working exploit for the antivirus that ships in every copy of Windows has been public for more than two weeks, and there is still no patch" ^R.
• Cloud Security Alliance noted that as of June 19 — nine days post-disclosure — no patch or out-of-band release timeline had been announced, calling the window "alarming" for a vulnerability that ships on every consumer and enterprise Windows system ^L.
• cve.tools reported that by July 1, 2026 (21 days post-disclosure), no patch existed, and the extended exposure was "unusual for a publicly exploited zero-day in a core security component" ^C.
• Multiple sources highlighted the irony that Microsoft's own antivirus engine — the last line of defense — was being used as the vector for SYSTEM-level compromise, and that the lack of urgency from Microsoft was raising questions about its vulnerability response processes ^MH.

The core frustration: because Defender is enabled by default on all Windows installations, the vulnerability has an enormous attack surface, yet no interim patch (out-of-band) was issued despite functional exploit code being publicly available ^HFL.

Interim Mitigations and Steps Organizations Should Take

Sources consistently recommend the following until Microsoft ships a permanent fix:

Apply the fix when available

• Update the Microsoft Malware Protection Engine (MsMpEng) once Microsoft releases a security update. This is typically delivered through Windows Update or Microsoft Update Catalog ^W.
• No fix existed as of July 10, 2026 — monitor the CVE advisory and Microsoft Security Response Center (MSRC) for an out-of-band release ^NC.

Interim mitigations (no patch available)

• Restrict local user accounts. Since the exploit requires interactive logon, minimize the number of standard users on sensitive systems ^KL.
• Enforce AppLocker or WDAC (Windows Defender Application Control) to block unauthorized executables and scripts from running, including untrusted PoC binaries ^LI.
• Enable ASR (Attack Surface Reduction) rules that can block credential theft and untrusted processes — though these may not directly stop the TOCTOU race ^F.
• Monitor for known exploit artifacts. The exploit relies on specific oplock and symbolic-link creation. Deploy EDR rules that alert on anomalous oplock usage and unexpected symlink creation by non-SYSTEM processes ^LF.
• Prioritize restricting physical/logical access to Windows endpoints for untrusted or unvetted users. This is the most reliable interim control since the vulnerability requires local code execution ^KL.
• Use least-privilege models — do not grant local admin rights to standard users, though note this does not prevent the exploit (it escalates from standard user to SYSTEM) ^CL.