Security News New Windows Defender 0-Day Exploit “RoguePlanet” Grants SYSTEM Access to Attackers

Parkinsond

Parkinsond

Level 63
Thread author
Verified
Top Poster
Well-known
Dec 6, 2023
5,289
16,520
6,169
Content source
https://cybersecuritynews.com/windows-defender-0-day-exploit-rogueplanet/
A researcher known as Nightmare Eclipse (also tracked as Chaotic Eclipse or Dead Eclipse) has publicly released a new proof-of-concept (PoC) exploit named RoguePlanet, targeting a previously undisclosed race condition vulnerability in Microsoft Windows Defender.

When successfully executed, the exploit spawns a command shell running under SYSTEM-level privileges, granting an attacker the highest possible access on a compromised Windows machine.

The exploit has been confirmed to work on fully patched Windows 10 and Windows 11 systems, including both the official stable and Canary Insider Preview channels, with the June 2026 patch applied.

cybersecuritynews.com

New Windows Defender 0-Day Exploit “RoguePlanet” Grants SYSTEM Access to Attackers

A researcher known as Nightmare Eclipse (also tracked as Chaotic Eclipse or Dead Eclipse) has publicly released a new proof-of-concept (PoC) exploit named RoguePlanet, targeting a previously undisclosed race condition vulnerability in Microsoft Windows Defender.
cybersecuritynews.com cybersecuritynews.com
Click to expand...
 
  • Like
  • Wow
  • Sad
Reactions: Sorrento, Fel Grossi, Wrecker4923 and 12 others
oldschool said:
Whitelisting protection such as Smart App Control and others can successfully prevent this exploit even if thie exploit goe from POC to in-the-wild RCE.
Click to expand...
MD is as good as its rivals; has its downsides also as they are.
The most peculiar downside its marketshare, making it the highest targeted AV by threat actors.
 
  • Like
  • Hundred Points
Reactions: Dave Russo, Sorrento, Zero Knowledge and 7 others
Whenever I read an article like this, I'm never worried. Chances of me being attacked using some kind of exploit are minimal, almost non-existent. 95% of vulnerabilities are only discovered in research labs by security researchers, never in the wild. Significant chunk of them also requires hacker to have a physical access to device rather exploiting it remotely—simply not happening.

Beside, if 0-day exploit was already being exploited in the wild, it would be noticed. Not only by Microsoft, but by millions of people reporting something off. Media tends to sensationalize articles because that makes them quick buck. Imagine if title said "new vulnerability discovered affecting Defender, but chances of you being attacked are 0"; no one would click on the article.
 
  • Like
  • +Reputation
  • Hundred Points
Reactions: Dave Russo, Divine_Barakah, Sorrento and 6 others
Marko :) said:
Significant chunk of them also requires hacker to have a physical access to device rather exploiting it remotely—simply not happening.
Click to expand...
In this case the requirement is not physical access, it requires only local account access. The POC is local attack, but it is publicly published and intended for hackers to modify. That means even if you are using a standard account, it will affect you - all it needs is to be run. Aside from phishing, there could be browser based drive-by-downloads, installing a malicious browser extension, infected USB sticks that pretend to be a usb keyboard, typosquatting, right-to-left attacks pretending to be a "fdp.rcs" (which evaluates to .scr screensaver) and malicious links, These might affect those who are following good security hygiene. And even proper security hygiene can be bypassed when you are tired or in a hurry. You might think the risk of exploits is minimal, but you must carefully evaluate all forms of attack before you make bold claims.

And beware, the attacker can be cleverer than you.
 
Last edited:
  • Like
  • +Reputation
  • Hundred Points
Reactions: Dave Russo, Sorrento, Brownie2019 and 4 others
It's not quite that simple.
An attacker could exploit a vulnerability (already present in the wild) that was fixed in Chrome version 149.0.7827.103.

Known Exploited Vulnerabilities Catalog | CISA

  • Every Chromium-based browser is always updated with a certain delay compared to Chrome.
  • Almost no one uses restrictive settings in the Anti-Exploit list.
  • Almost no one goes beyond the default settings for the sandbox.

;)
 
Last edited:
  • Like
Reactions: Sorrento, Brownie2019, Wrecker4923 and 3 others
Victor M said:
So who is saying that hackers have all gone over to cybercrime and work only for money ?
Click to expand...
They have all gone for the money. Whether it's cyber crime, pen testers, bug bounties, ransomware, stealing crypto. It's big business, this is the American way.

No one is posting full disclosure now unless the targeted company refuses to pay. This guy/girl/she/they/it could of sold this bug to any number of vuln brokers.

The fact they didn't either means they work inside MS or they have an axe to grind. How much did they ask for & how much MS offered as a reward is unknown.
 
  • Like
Reactions: Dave Russo, simmerskool, Sorrento and 3 others
Microsoft has confirmed a newly disclosed zero-day vulnerability, tracked as CVE-2026-50656, affecting Microsoft Defender, following the public release of a proof-of-concept (PoC) exploit dubbed “RoguePlanet” by security researcher NightmareEclipse.

The vulnerability, classified as an elevation-of-privilege flaw, was officially published on June 16, 2026, and is already drawing attention due to its reliability and ability to bypass key Defender protections under multiple configurations.

RoguePlanet Zero-Day Exploit
According to Microsoft’s advisory, the issue stems from a link-following weakness (CWE-59: Improper Link Resolution Before File Access), which allows attackers with low privileges to escalate access on vulnerable systems by improperly handling symbolic links.
Click to expand...
Read more on:
gbhackers.com

Microsoft Confirms RoguePlanet Zero-Day Exploit Targeting Defender

Microsoft has confirmed a newly disclosed zero-day vulnerability, tracked as CVE-2026-50656, affecting Microsoft Defender.
gbhackers.com gbhackers.com
 
  • Like
Reactions: Dave Russo, simmerskool and Sorrento
  • Like
Reactions: Zero Knowledge, Dave Russo, simmerskool and 2 others
Khushal said:
The vuln finder's observations on Microsoft's fix.
Click to expand...
Blocked by ControlD native blocklist
1783592981711.png
 
  • Sad
  • Like
  • HaHa
Reactions: Zero Knowledge, simmerskool and Khushal
Parkinsond said:
Blocked by ControlD native blocklist
View attachment 298709
Click to expand...
As many of you may have seen, Microsoft issued a security patch for RoguePlanet

Security Update Guide - Microsoft Security Response Center

msrc.microsoft.com msrc.microsoft.com

There is a problem in mpengine.dll, the newly introduced mitigations or as Microsoft calls them "defense-in-depth updates" can cause windows defender to leak 8 bytes of data while attempting to open a file in certain scenarios, I'm still trying to find a way to obtain the leaked bytes as a standard user but for now it only leaks data to drivers.

Now one thing I noticed with Windows Defender is the fact that it is very careful when handling file sizes, there is hard limits on how big the file can be when scanning and quarantining files.
This implementation make sense, because quarantining a huge file will cause Defender to completely exhaust the available disk space.
I found a small exception to this rule, apparently the spynet functions in mpengine.dll really wants to keep a local copy of :Zone.Identifier ADS file and it does not matter how big this file is, Windows Defender will cache it locally anyways.

You will need a special setup to exploit this, a custom SMB server that will be handling requests from Windows Defender is needed, the SMB server should serve a malicious file (a good example is mimikatz executable) followed by a massive ADS file (a good example is mimikatz.exe:Zone.Identifier), in the process of replying to the read requests, at some point the SMB server should never respond to the read request but keep the connection alive. This will cause Defender to hang and keep a lock on the offending files that holds the entire disk space.
Obviously this won't crash the machine but windows won't behave properly with a full disk, multiple apps and services crash randomly.

I managed to reproduce this issue in Windows 11 25H2 and Windows Server 2025, visiting an SMB server will cause Defender to completely exhaust your disk space. I'm trying to get it to work with webdav so we can skip the authentication requirement, I'm not sure if it's possible because attempting to open an ADS in a webdav causes the request to fail with STATUS_INVALID_PARAMETERS, I'm not sure if it's a problem with my custom webdav implementation because it shows the ADS open attempt as a weird "file.exe/%3AZone.Identifier" so maybe I'm doing smtg wrong but it might work.

I was thinking about a way to exploit this remotely without needing a victim to open your special SMB server but nothing crossed my mind. If there was a way to convince Defender to scan files remotely then this issue is exploitable and would be very powerful against servers.
Click to expand...
 
  • Like
  • Thanks
Reactions: simmerskool and Parkinsond
Yeah, the host is on “HaGeZi’s Threat Intelligence Feeds DNS Blocklist” as well; the host also appeared to have been listed by Malwarebytes.

Some of these look like blog entries from NightmareEclipse himself. Retribution, young domain, etc.?

Clean on MalwareTips.
 
Last edited by a moderator:
  • Like
  • +Reputation
Reactions: simmerskool, Parkinsond and Khushal

You may also like...