RoguePlanet is a local privilege escalation vulnerability (CVE-2026-50656, CVSS 7.8) in the Microsoft Malware Protection Engine component of Microsoft Defender. It exploits a race condition to spawn a command prompt with System privileges on Windows 10 and 11, including systems with June 2026 patches installed. The proof-of-concept exploit bypasses mitigations introduced in May 2026 and works regardless of Defender's real-time protection or passive mode. Microsoft has acknowledged the issue and is developing a security update but has not yet provided a patch. The vulnerability was publicly disclosed by the security researcher Nightmare Eclipse, known for releasing multiple zero-day exploits against Microsoft products.

Successful exploitation allows local attackers to escalate privileges to System level on affected Windows systems, potentially enabling full control over the system. The exploit works on Windows 10 and 11 with recent patches, bypassing Defender's protections. There are no reports of active exploitation in the wild at this time.

Microsoft is actively working on a security update to address this vulnerability. No official patch is currently available. Users should monitor Microsoft's advisory for the release of the update. Since the exploit works regardless of Defender's real-time protection status, disabling or enabling Defender features does not mitigate the risk. Until a patch is released, no effective workaround is provided by Microsoft.