RoguePlanet is a Microsoft Defender zero-day vulnerability involving a race condition that enables privilege escalation to SYSTEM level on Windows 10 and 11 with June 2026 updates. The exploit, released publicly as a proof-of-concept by the researcher Chaotic Eclipse, allows attackers to execute arbitrary code with full system privileges. While the exploit is not fully reliable on all machines, it has demonstrated a 100% success rate on some tested systems. The vulnerability does not currently work on Windows Server due to user restrictions on mounting ISO images, though the underlying flaw affects those systems as well. This disclosure follows a series of similar vulnerabilities found by the same researcher, who has publicly criticized Microsoft's vulnerability management and disclosure process. Microsoft has publicly condemned the uncoordinated disclosures but has not announced a patch or mitigation. The exploit is a race condition and involves bypassing Defender protections related to path redirection and memory corruption.

Successful exploitation of the RoguePlanet zero-day grants attackers SYSTEM-level privileges on affected Windows 10 and 11 desktop systems, enabling arbitrary code execution and unauthorized actions with the highest system rights. This level of access can lead to full system compromise. The exploit works on fully patched systems as of June 2026, indicating that current updates do not mitigate this vulnerability. Windows Server systems are vulnerable but not exploitable with the current proof-of-concept due to mounting restrictions. There are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Microsoft has not publicly released a fix for this vulnerability as of the information available. Organizations should monitor official Microsoft Security Response Center (MSRC) advisories for updates. Since the exploit is a race condition involving Defender components, temporary mitigations are not detailed in the available information. Avoid running untrusted code and consider limiting user privileges where possible until an official patch is released.