Ethical Hacking News
Microsoft's Malware Protection Engine has been patched for a critical vulnerability known as RoguePlanet (CVE-2026-50656). This exploit was discovered by security researcher Chaotic Eclipse, who published a proof-of-concept code. The issue allows attackers to gain elevated privileges and potentially compromise the security controls of a system.
Microsoft has addressed a critical vulnerability in its Malware Protection Engine, RoguePlanet (CVE-2026-50656), allowing attackers to gain elevated privileges. A race condition flaw was discovered, providing SYSTEM-level privileges and potentially compromising system security controls. The issue was initially broken by Microsoft updates but has now been fixed in the latest version of the Malware Protection Engine (mpengine.dll). Microsoft released an update for Microsoft Defender with additional security hardening updates to address the flaw. The RoguePlanet exploit currently does not work on Windows Server due to standard user limitations, but server installations are still vulnerable. Keeping software up to date and following best practices for security is crucial in preventing such incidents. This vulnerability highlights the need for ongoing monitoring and patching of software vulnerabilities to prevent similar incidents.
Microsoft has recently addressed a critical vulnerability in its Malware Protection Engine, known as RoguePlanet (CVE-2026-50656). This flaw was discovered by security researcher Chaotic Eclipse, also known as Nightmare-Eclipse, who published a proof-of-concept exploit for the vulnerability. The exploit allows an attacker to gain elevated privileges and potentially compromise the security controls of a system.
The issue is attributed to a race condition that can provide attackers with SYSTEM-level privileges, allowing them to execute code with the highest permissions. This flaw was discovered after Microsoft updates initially broke the researcher's prototype, but it has now been fixed in the latest version of the Malware Protection Engine (mpengine.dll).
Microsoft acknowledged the vulnerability in mid-June and stated that it is aware of the issue and was actively developing a security update to address the flaw and protect affected systems. The company released an update for Microsoft Defender, which includes additional security hardening updates.
The RoguePlanet exploit currently does not work on Windows Server because standard users cannot mount ISO images, although the researcher claims that the underlying vulnerability still affects server installations and only requires a different exploitation method.
In an update published by the researcher, he claimed that the RoguePlanet PoC works regardless of whether real-time protection is enabled or disabled, as well as possibly in passive mode. The issue was fixed in Microsoft Malware Protection Engine version 1.1.26060.3008.
This vulnerability highlights the importance of keeping software up to date and following best practices for security. It also serves as a reminder that even patched systems may still be vulnerable to certain types of attacks.
Furthermore, this vulnerability is not an isolated incident, as it is the fourth Defender flaw reported by Chaotic Eclipse. This underscores the need for ongoing monitoring and patching of software vulnerabilities to prevent such incidents from occurring in the future.
In conclusion, Microsoft has addressed a critical vulnerability in its Malware Protection Engine, RoguePlanet (CVE-2026-50656), which allows attackers to gain elevated privileges and potentially compromise security controls. The company released an update that fixes this flaw and provides additional security hardening updates.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Deep-Dive-into-Microsofts-Defender-Flaw-RoguePlanet-CVE-2026-50656-ehn.shtml
https://securityaffairs.com/195016/security/microsoft-fixed-defender-flaw-rogueplanet-cve-2026-50656.html
Published: Thu Jul 9 06:15:57 2026 by llama3.2 3B Q4_K_M
