VulnSocial
← Back to blog

CVE-2026-50656 – High‑Severity Local Privilege Escalation in Microsoft Defender (RoguePlanet)

TL;DR

  • Severity: High (CVSS 7.0–7.8)
  • Impact: Local attacker can gain SYSTEM privileges via a race condition in the Microsoft Malware Protection Engine.
  • Active exploitation: Reported within days of disclosure; public PoC and exploit code exist.
  • Affected: All Windows 10/11 installations with Microsoft Defender (Malware Protection Engine) prior to the July 2026 update.
  • Action: Deploy the July 2026 Defender update immediately; monitor for exploit activity.

Overview

  • The vulnerability, publicly named RoguePlanet, is tracked as CVE-2026-50656.
  • Disclosed on 2026‑06‑16 (NVD) and publicly discussed on 2026‑06‑17. Microsoft confirmed the flaw and released a patch on 2026‑07‑09.
  • It is a local privilege escalation (LPE) bug in the Microsoft Malware Protection Engine component of Microsoft Defender.
CVESeverityCVSS (NIST)Product
CVE-2026-50656High7.0 (NIST)Microsoft Defender – Malware Protection Engine

Technical Details

  • The flaw is a race condition (CWE‑59) in the way the Malware Protection Engine handles certain file‑system operations.
  • An unprivileged local user can trigger the race to cause the engine to execute code with SYSTEM privileges, effectively taking full control of the host.
  • The vulnerability is local (Attack Vector: L), requires no user interaction (UI:N), and can be exploited with low complexity (AC:L per Microsoft) or moderate (AC:H per NIST).
  • Public proof‑of‑concept (PoC) code and exploit scripts were released on GitHub shortly after disclosure, leading to multiple reports of active exploitation.

Severity & Impact

  • CVSS 3.1: AV:L / AC:L (or AC:H) / PR:L / UI:N / S:U / C:H / I:H / A:H → High.
  • Confidentiality, Integrity, Availability: All three are rated High because the attacker obtains SYSTEM rights, enabling data theft, tampering, and denial‑of‑service.
  • The vulnerability affects any Windows 10/11 system with the vulnerable version of the Malware Protection Engine, which is enabled by default on most enterprise endpoints.

Affected Products

  • Vendor: Microsoft
  • Component: Microsoft Defender – Malware Protection Engine
  • Operating Systems: Windows 10, Windows 11 (all editions with Defender enabled) prior to the July 2026 update.

For the exhaustive list of affected versions and CPEs, see the VulnSocial CVE page.

What Security Teams Should Do

  1. Deploy the patch immediately – the fix is available in the July 2026 Defender update (see Microsoft advisory). Deploy via WSUS, SCCM, Intune, or Windows Update.
  2. Verify patch status – query installed updates with PowerShell: 
    Get-HotFix -Id KBxxxxxxx
    Replace KBxxxxxxx with the KB number from the advisory.
  3. Monitor for Indicators of Compromise (IoCs) – look for processes spawning MsMpEng.exe with elevated token, unexpected SYSTEM child processes, or the known exploit binaries (see the GitHub repo for hashes).
  4. Enforce least‑privilege – restrict local user accounts from executing arbitrary binaries; consider disabling the Malware Protection Engine on high‑risk systems if you cannot patch immediately.
  5. Leverage threat‑intel feeds – track real‑time activity on the VulnSocial CVE page for spikes in exploit attempts.

Remediation & Mitigation Steps

  1. Patch – Apply the July 2026 Defender update (KBxxxxxx). This addresses the race condition in the Malware Protection Engine.
  2. Validate – After patching, confirm the version of MsMpEng.exe matches the patched build (e.g., version ≥ X.Y.Z).
  3. Hardening – If patching cannot be performed immediately:
    • Disable the Malware Protection Engine via Group Policy (Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Turn off Microsoft Defender Antivirus).
    • Enable Windows Defender Application Control (WDAC) to block unsigned binaries.
  4. Detection – Deploy EDR rules to alert on:
    • Creation of new SYSTEM processes by MsMpEng.exe.
    • Execution of known exploit file hashes (see GitHub repo).
  5. Incident Response – If you suspect compromise, isolate the host, collect forensic artifacts (process tree, token information), and consider a full system rebuild.

Bottom Line

  • CVE-2026-50656 is a High‑severity LPE in Microsoft Defender that allows local attackers to obtain SYSTEM privileges via a race condition.
  • Active exploitation was observed within days of disclosure, and public exploit code is available.
  • Immediate patching is the only reliable mitigation. Use the Microsoft advisory and the VulnSocial CVE page for updates and real‑time intel.

References

#CVE #CVE202650656 #High #Microsoft #Defender #RoguePlanet #LPE #Patch