On June 10, 2026, the anonymous security researcher known as Nightmare Eclipse (also Chaotic Eclipse / MSNightmare) publicly released a proof-of-concept exploit dubbed “RoguePlanet” targeting a previously unknown race condition vulnerability in Microsoft Defender. The exploit can grant SYSTEM-level privileges on fully patched Windows 10 and Windows 11 machines — including those with the June 2026 Patch Tuesday updates installed.
RoguePlanet exploits a race condition in how Microsoft Defender handles certain operations, allowing an attacker to escalate from a standard user account to full SYSTEM access. The researcher claims a 100% success rate on some configurations. The exploit does not currently work on Windows Server editions because standard users cannot mount ISO images, though the underlying vulnerability likely exists there too. Microsoft has not yet issued a patch for this specific flaw.
This release is the latest in a series of zero-day disclosures from Nightmare Eclipse, who has been publicly feuding with Microsoft over vulnerability reporting procedures and account terminations. Previous disclosures include BlueHammer (CVE-2026-33825), UnDefend (CVE-2026-45498), and RedSun (CVE-2026-41091) — several of which have been confirmed exploited in the wild.
Source
Reported by The Hacker News, Security Affairs, and Help Net Security.
Commentary
The Nightmare Eclipse situation has become a genuine security crisis. Regardless of the merits of the researcher’s grievance with Microsoft, the practical outcome is a steady stream of weaponizable zero-days being dropped publicly with no coordinated disclosure window. RoguePlanet is particularly nasty because it bypasses the very security tool — Defender — that most Windows environments rely on as their baseline protection. The fact that fully patched systems remain vulnerable means there is currently no mitigation beyond monitoring for suspicious privilege escalation. Enterprise defenders should treat this as an active threat and watch for indicators of compromise associated with Defender process manipulation.