{"id":1675,"date":"2026-07-09T10:34:29","date_gmt":"2026-07-09T10:34:29","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1675"},"modified":"2026-07-09T10:34:29","modified_gmt":"2026-07-09T10:34:29","slug":"microsoft-patches-rogueplanet-defender-flaw-that-can-grant-system-privileges","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1675","title":{"rendered":"Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jul 09, 2026<\/span><\/span>Vulnerability \/ Endpoint Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Microsoft has released security updates for a Defender vulnerability known as RoguePlanet, nearly a month after details of the flaw became public.<\/p>\n

The vulnerability, tracked as CVE-2026-50656<\/a><\/strong> (CVSS score: 7.8), is a privilege escalation issue in the Microsoft Malware Protection Engine (\u00abmpengine.dll\u00bb), which provides scanning, detection, and cleaning capabilities for its antivirus and antispyware software.<\/p>\n

The issue has been remediated in Microsoft Malware Protection Engine version 1.1.26060.3008, along with defense-in-depth updates to harden unspecified security-related features.\u00a0<\/p>\n

RoguePlanet was first disclosed by a security researcher named Chaotic Eclipse (aka Nightmare-Eclipse), describing it as a race condition that could be abused to spawn a shell with SYSTEM-level privileges. This, in turn, grants the attacker the ability to run arbitrary code or perform unauthorized actions.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The exploit has been found to work on systems running up-to-date versions of Windows with the June 2026 Patch Tuesday updates installed. Subsequently, Chaotic Eclipse also revealed that the exploit works regardless of whether real-time protection is on or not. Microsoft has not officially credited Chaotic Eclipse with the vulnerability discovery.<\/p>\n

RoguePlanet is the fourth Defender vulnerability disclosed by the researcher after BlueHammer (CVE-2026-33825), UnDefend (CVE-2026-45498), and RedSun (CVE-2026-41091), all of which have since been patched by Microsoft.<\/p>\n

The Windows maker said no customer action is required to install the update for CVE-2026-50656, as the software is frequently updated to secure customers against new and evolving threats.<\/p>\n

\u00abFor enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically,\u00bb Microsoft said.<\/p>\n

\u00abDepending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Jul 09, 2026Vulnerability \/ Endpoint Security Microsoft has released security updates for a Defender vulnerability known as RoguePlanet, nearly a month after details of the flaw became public. The…<\/p>\n","protected":false},"author":1,"featured_media":1676,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1246,70,2437,147,57,363,1987,1045],"class_list":["post-1675","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-defender","tag-flaw","tag-grant","tag-microsoft","tag-patches","tag-privileges","tag-rogueplanet","tag-system"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1675","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1675"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1675\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1676"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1675"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1675"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1675"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}