RoguePlanet is a race condition vulnerability in Windows Defender disclosed by Chaotic Eclipse and publicly available as a proof-of-concept on GitHub. The exploit attempts to gain SYSTEM privileges by exploiting a timing issue. It has been tested on Windows 10 and Windows 11 with the June 2026 patches installed, achieving up to 100% success on some machines but less on others. Although the PoC does not currently work on Windows Server due to ISO mounting restrictions for standard users, the author believes all Windows Server versions are vulnerable and that the exploit could be redesigned to work there as well. The vulnerability allows spawning a SYSTEM shell upon successful exploitation.

Successful exploitation of this race condition vulnerability in Windows Defender allows an attacker to escalate privileges to SYSTEM level, granting full control over the affected Windows machine. This could enable execution of arbitrary code with the highest privileges, potentially compromising system integrity and confidentiality. The exploit's success rate varies by machine and environment, and currently does not work on Windows Server without modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the exploit targets a race condition in Windows Defender, monitor official Microsoft advisories for patches or mitigations. No official fix or temporary workaround is currently documented. Until a patch is available, limit exposure by restricting user permissions and monitoring for suspicious privilege escalation attempts. Note that the PoC requires mounting ISO images, which may limit exploitation on some systems.