Loading vulnerability…
RoguePlanet is a local elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender. The flaw arises from improper link resolution before file access during Defender remediation, combined with a race condition. An attacker can manipulate path resolution while the engine performs a privileged remediation operation, causing an operation executing in the SYSTEM context to act on an attacker-controlled destination. Microsoft remediated the originally disclosed issue in Malware Protection Engine version 1.1.26060.3008; subsequent public research reported a separate patch bypass, tracked as CVE-2026-69414.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository is a Windows-focused local exploit PoC for CVE-2026-50656, described as a Microsoft Defender patch bypass ('ShieldBreak'). The repo is small and centered around a single substantial C++ source file, ShieldBreak-MSNightmare/ShieldBreak.cpp, plus Visual Studio project files, a resource header, and documentation. The top-level README mainly wraps and references the upstream ShieldBreak project, while the nested ShieldBreak-MSNightmare directory contains the actual exploit implementation. The exploit is not a framework module and appears to be a standalone Visual Studio C++ application. Its code imports numerous Windows-specific APIs and libraries including ntdll, Cloud Files API (cfapi), COM/OLE, ACL APIs, and Task Scheduler interfaces. The visible code shows embedded resources for a ZIP and DLL, suggesting the executable carries staged artifacts internally. Project metadata further references eicar_com.zip, Report.wer, ShellDll.dll, and Warden.dll, indicating the exploit likely uses a Defender-detectable sample plus one or more DLL payloads and a crafted WER report. Operationally, the exploit appears to be a local attack chain rather than a remote/network exploit. It creates files and directories, interacts with Cloud Files sync-root functionality, sets up a named pipe for synchronization, and uses COM to connect to the Windows Task Scheduler service. It specifically opens the task folder '\Microsoft\Windows\Windows Error Reporting', retrieves the 'QueueReporting' task, and runs it. This strongly suggests the exploit abuses Windows Error Reporting task execution as part of the bypass chain. After successful execution it prints '[+] Exploit succeeded.' and performs cleanup by disconnecting/unregistering the sync root and deleting staged files/directories. No external network C2, hardcoded IPs, or remote URLs are present in the exploit code shown. The notable fingerprintable targets are local Windows components: the Windows Error Reporting scheduled task path, temporary/staged files, embedded DLL/ZIP resources, and named-pipe-based IPC. Overall, this is a real exploit PoC with embedded payload/staging capability, intended to demonstrate a local Defender bypass on modern Windows systems rather than merely detect the vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
253 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previously disclosed vulnerability in Microsoft software whose patch was bypassed by ShieldBreak.
A Microsoft Defender race-condition zero-day vulnerability that Microsoft patched on July 19, 2026; subsequent ShieldBreak and ShieldCrash exploits are described as bypasses of the associated fixes.
A Microsoft Malware Protection Engine patch-bypass vulnerability, branded RoguePlanet, that was patched in July 2026.
An elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine involving a virtual-disk race condition and improper link resolution. It is the first vulnerability in the described Defender patch-bypass lineage.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.