Summary
A dangerous zero-day vulnerability dubbed “RoguePlanet” (CVE-2026-50656) is actively threatening Windows 10 and Windows 11 systems after security researcher Nightmare Eclipse publicly released a working proof-of-concept exploit on GitHub on June 10, 2026. The local privilege escalation flaw targets Microsoft Defender’s real-time scanning and quarantine pipeline, exploiting a Time-of-Check to Time-of-Use (TOCTOU) race condition to achieve SYSTEM-level code execution.
The exploit abuses Defender’s remediation workflow by chaining NTFS directory junctions, opportunistic locks, and the Volume Shadow Copy service to swap the legitimate wermgr.exe binary with an attacker-controlled payload. A scheduled task then executes the malicious binary with the highest available privileges. Microsoft has acknowledged the vulnerability and confirmed it is developing a security update, but as of June 18, no patch is available.
Security teams are advised to implement application control policies that block execution from user-writable locations like %TEMP%, monitor for anomalous Defender-related file activity, and watch for suspicious execution of the QueueReporting scheduled task.
Source
Help Net Security — RoguePlanet Zero-Day CVE-2026-50656 · SecurityWeek — Microsoft Working on Patch
Commentary
This is a particularly nasty vulnerability because it weaponizes the very security tool that defenders rely on. Exploiting Defender’s own quarantine pipeline to achieve SYSTEM privileges is both elegant and deeply concerning — it means the act of scanning a file can be turned against the endpoint. The public PoC release before a patch was available has put Microsoft in a difficult position.
Organizations running Windows Defender as their primary EDR should treat this as urgent. The lack of a vendor patch makes mitigation through application control and behavioral monitoring critical in the interim. Watch for Microsoft’s out-of-band update — this is too high-profile to wait for July Patch Tuesday.