Loading story…
Microsoft said it is preparing a security update for RoguePlanet, a publicly disclosed Microsoft Defender zero-day tracked as CVE-2026-50656. The flaw affects fully patched Windows 10 and Windows 11 systems and allows local privilege escalation to SYSTEM by exploiting a race condition in the Microsoft Malware Protection Engine. Researcher Nightmare Eclipse released a public proof-of-concept exploit, and reports said the issue can be triggered whether Defender real-time protection is enabled or disabled, with possible impact in passive mode as well.
The researcher said the bug may originally have supported remote code execution before Microsoft hardening changes in May blocked some attack paths, after which the exploit was reworked to bypass mitigations. Microsoft acknowledged the vulnerability and said it is investigating while developing a patch. The disclosure comes amid an ongoing dispute between Nightmare Eclipse and Microsoft over bug bounty and coordinated disclosure practices, and follows several other Windows flaws the researcher has publicly exposed, including BlueHammer, RedSun, UnDefend, GreenPlasma, and YellowKey.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Nightmare Eclipse said the vulnerability may originally have enabled remote code execution, but Microsoft hardening changes made in May closed some exploitation paths. The researcher then reworked the proof-of-concept to bypass those mitigations.
LevelBlue SpiderLabs analyzed and published detection guidance for GreatXML, a post-exploitation technique that abuses WinRE answer-file processing and Defender offline-scan state to preserve access to BitLocker-protected data after administrative compromise. The report said no patch addressing GreatXML’s root cause had been released at the time of writing and described recovery-partition artifacts and related behaviors defenders should monitor.
Microsoft acknowledged the publicly disclosed RoguePlanet zero-day and said it is investigating the issue and developing a security update. The company identified the flaw as CVE-2026-50656 and confirmed work on a patch for Microsoft Defender.
Researcher Nightmare Eclipse publicly disclosed the Microsoft Defender zero-day dubbed RoguePlanet, now tracked as CVE-2026-50656, and released a proof-of-concept exploit. The flaw affects fully patched Windows 10 and Windows 11 systems and can be exploited for local privilege escalation to SYSTEM via a race condition in the Microsoft Malware Protection Engine.
Public proof-of-concept exploit code for the Microsoft Defender flaw later tracked as CVE-2026-50656 was released by researcher Nightmare Eclipse / Chaotic Eclipse. The exploit demonstrated local privilege escalation to NT AUTHORITY\SYSTEM on fully patched Windows systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethecyberexpress.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceblog.projectnightcrawler.dev
Open sourceblog.projectnightcrawler.dev
Open sourceresearch.splunk.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A proof-of-concept exploit for a new Microsoft Defender local privilege escalation flaw dubbed **RedSun** was published by researcher **Chaotic Eclipse**, with reports saying it works on fully patched **Windows 10**, **Windows 11**, and **Windows Server 2019 and later** when Defender is enabled. The zero-day allows an unprivileged local user to gain **SYSTEM** privileges by abusing Defender’s handling of files tagged by cloud detection, and Microsoft had not released a patch at the time of reporting. Independent researcher **Will Dormann** reportedly validated the exploit chain, which uses the **Windows Cloud Files API**, opportunistic locks, and **NTFS junctions/reparse points** to redirect Defender into overwriting a protected binary under `C:\Windows\System32` and then executing it as SYSTEM. The disclosure followed an earlier Defender privilege-escalation exploit, **BlueHammer**, which Microsoft patched as `CVE-2026-33825`, while defenders were urged to watch for anomalous Defender file writes, `cldapi.dll` activity, and oplock-assisted redirection behavior pending a vendor fix.
Jun 29, 2026
Microsoft disclosed active exploitation of two vulnerabilities in Microsoft Defender, **CVE-2026-41091** and **CVE-2026-45498**, prompting CISA to add both flaws to its **Known Exploited Vulnerabilities** catalog. **CVE-2026-41091** affects the Microsoft Malware Protection Engine and is a local privilege escalation issue tied to improper link resolution in Defender’s scanning logic, allowing an authenticated local attacker to obtain **SYSTEM** privileges. **CVE-2026-45498** affects the Microsoft Defender Antimalware Platform and can cause a denial of service that impairs or crashes Defender protection capabilities. Microsoft released fixes in **Microsoft Malware Protection Engine `1.1.26040.8`** and **Microsoft Defender Antimalware Platform `4.18.26040.7`**, with updates delivered through normal Defender mechanisms rather than a separate manual patch. CISA ordered U.S. federal civilian agencies to remediate or discontinue affected products by **June 3, 2026** under **BOD 22-01**. Reporting also linked the exploitation activity to public proof-of-concept releases by researcher **Nightmare Eclipse**, with Huntress observing attackers using Defender exploit code in the wild.
Jun 29, 2026
A security researcher using the aliases **Chaotic Eclipse** and **Nightmare-Eclipse** publicly released working GitHub exploit code for **BlueHammer**, an unpatched Windows local privilege escalation flaw tied to Microsoft Defender’s signature update process. Independent testing by Will Dormann and others found the exploit worked, though reliability varied by platform and configuration. The attack abuses a **TOCTOU** race condition and path confusion in Defender’s update workflow, chaining components such as **VSS**, the **Cloud Files API**, and opportunistic locks to expose protected registry hives including `SAM`, `SYSTEM`, and `SECURITY`, extract NTLM password hashes, and potentially elevate a low-privileged user to **NT AUTHORITY\SYSTEM**. Microsoft initially responded with a Defender detection signature for the published proof of concept, but researchers warned that signature-based blocking did not address the underlying logic flaw. The issue was later tracked as **`CVE-2026-33825`** and patched by Microsoft on April 14, after which **CISA** ordered U.S. federal civilian agencies to remediate it within two weeks and added it to the **Known Exploited Vulnerabilities** catalog. Huntress reported the vulnerability was being used in zero-day intrusions involving hands-on-keyboard activity, and follow-on tooling such as **BlueSAM** showed how quickly the public disclosure was adapted for offensive use.
Jul 1, 2026