CVE-2026-50656: Microsoft Defender RoguePlanet LPE, public PoC live for 29 days

Microsoft Defender’s scan engine has a TOCTOU race (RoguePlanet). Symlink hijack redirects SYSTEM file ops to an arbitrary path and yields NT AUTHORITY\SYSTEM. PoC was public 29 days before the patch.

On 8 July 2026, Microsoft shipped an out-of-band emergency patch for CVE-2026-50656 (RoguePlanet), a high-severity local privilege escalation in the Microsoft Defender scan engine. The bug is a Time-of-Check to Time-of-Use (TOCTOU) race. An attacker hijacks a symlink, redirects Defender’s SYSTEM-level file operations to an arbitrary path, and obtains NT AUTHORITY\SYSTEM. Public PoC was live for 29 days before the patch.

Incident Overview

Nightmare-Eclipse (aka Chaotic Eclipse) published RoguePlanet on 10 June 2026 — hours after Microsoft’s June Patch Tuesday. That timing kept the fix out of the monthly cycle. Patched Windows 10 and 11 systems stayed exposed for 29 days.

Microsoft released the OOB update on 8 July 2026: Malware Protection Engine 1.1.26060.3008.

Technical Details

Mechanism

The bug sits in the file-scan path of Microsoft Malware Protection Engine (`mpengine.dll`). `MsMpEng.exe` runs as SYSTEM and handles real-time and on-demand filesystem scans.

TOCTOU race:

• Check: Defender validates the path before scan and confirms a regular file, not a symlink
• Window: short gap between path validation and the actual file open
• Use: attacker swaps the legitimate file for a symlink to a sensitive system path

Once triggered, Defender touches the attacker-controlled target as SYSTEM. Attacker gets a SYSTEM command line.

Extra risk

Nightmare-Eclipse reports the PoC works with Defender real-time protection on or off, and may still work in Defender passive mode — common when third-party AV is installed.

CVSS

| Version | Score | Severity | Vector | | --- | --- | --- | --- | | CVSS 3.1 | 7.8 | High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |

Impact

Exposure timeline

• 10 June: PoC public
• 16 June: Microsoft confirms the bug and assigns the CVE
• 8 July: OOB patch ships
• Exposure window: 29 days

Compounding risk

Stacks with BlueHammer (CVE-2026-33825), a Defender LPE patched in April that remains unpatched on tens of thousands of endpoints and has confirmed ransomware use. Some estates face both Defender LPEs at once.

Remediation

Patch now

Confirm Malware Protection Engine 1.1.26060.3008 or later on every endpoint. The engine usually auto-updates; verify anyway:

• Windows Security → Virus & threat protection → Check for updates
• Or check engine version via PowerShell

Mitigations

• Restrict local code execution
• App allowlisting (WDAC, ThreatLocker)
• Watch for anomalous SYSTEM process elevation
• Review Defender passive-mode configs

References

• Microsoft Security Response Center
• NVD: CVE-2026-50656
• InfoSec Industry: Week in Review
• Technical blog: RoguePlanet deep dive