RoguePlanet exploits a race condition in Microsoft Defender to achieve local privilege escalation to SYSTEM on Windows 10 and Windows 11 systems, including those with the June 2026 security updates installed. The exploit involves tricking the victim into opening a malicious .vhd(x) file hosted on a remote SMB server or accessing a malicious SMB share, causing Defender to redirect a cleaned file to a new location. Initial mitigations released by Microsoft in May 2026 closed some attack paths, but the exploit was reworked to bypass these mitigations. The proof-of-concept does not reliably work on Windows Server editions, though the researcher suspects those versions are vulnerable and could be targeted with further refinement. RoguePlanet was released shortly after Microsoft patched other zero-days disclosed by the same researcher. Microsoft has not yet issued a patch specifically for RoguePlanet, and the exploit has not been seen exploited in the wild.

Successful exploitation of RoguePlanet results in local privilege escalation, allowing an attacker with local access to gain SYSTEM-level privileges on affected Windows 10 and Windows 11 machines. This elevation of privilege could enable attackers to execute arbitrary code with the highest system privileges, potentially leading to full system compromise. The exploit does not currently provide remote code execution by itself but may be combined with other techniques. The exploit has not been observed in the wild and is currently a proof-of-concept.

As of the information provided, there is no official patch or fix specifically addressing the RoguePlanet exploit. Microsoft deployed mitigations in May 2026 that closed some attack vectors used by the exploit, but the researcher reworked the exploit to bypass these mitigations. Organizations should monitor official Microsoft advisories for updates or patches addressing this vulnerability. Since the exploit requires local access, restricting local user permissions and controlling access to SMB shares and removable media may reduce risk. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.