Security News New Windows Defender 0-Day Exploit “RoguePlanet” Grants SYSTEM Access to Attackers

Marko :) said:
Whenever I read an article like this, I'm never worried. Chances of me being attacked using some kind of exploit are minimal, almost non-existent. 95% of vulnerabilities are only discovered in research labs by security researchers, never in the wild. Significant chunk of them also requires hacker to have a physical access to device rather exploiting it remotely—simply not happening.

Beside, if 0-day exploit was already being exploited in the wild, it would be noticed. Not only by Microsoft, but by millions of people reporting something off. Media tends to sensationalize articles because that makes them quick buck. Imagine if title said "new vulnerability discovered affecting Defender, but chances of you being attacked are 0"; no one would click on the article.
Click to expand...
In 2026,

CVE-2026-20805 (Jan-2026)

In Feb, 5 vulnerabilities that were exploited in the wild (CVE-2026-21510), (CVE-2026-21513), (CVE-2026-21514), and (CVE-2026-21519)

In May and June, (CVE-2026-41089), (CVE-2026-33825), (CVE-2026-41091), and (CVE-2026-45498).
 
  • Like
Reactions: Wrecker4923, simmerskool and Khushal
Victor M said:
In this case the requirement is not physical access, it requires only local account access. The POC is local attack, but it is publicly published and intended for hackers to modify. That means even if you are using a standard account, it will affect you - all it needs is to be run. Aside from phishing, there could be browser based drive-by-downloads, installing a malicious browser extension, infected USB sticks that pretend to be a usb keyboard, typosquatting, right-to-left attacks pretending to be a "fdp.rcs" (which evaluates to .scr screensaver) and malicious links, These might affect those who are following good security hygiene. And even proper security hygiene can be bypassed when you are tired or in a hurry. You might think the risk of exploits is minimal, but you must carefully evaluate all forms of attack before you make bold claims.

And beware, the attacker can be cleverer than you.
Click to expand...
And we should not forget:

1- Remote code execution
2- Local privilege escalation and the word local here does not mean physical access.
 
  • Like
Reactions: Wrecker4923, simmerskool and Khushal
Divine_Barakah said:
In 2026,

CVE-2026-20805 (Jan-2026)

In Feb, 5 vulnerabilities that were exploited in the wild (CVE-2026-21510), (CVE-2026-21513), (CVE-2026-21514), and (CVE-2026-21519)

In May and June, (CVE-2026-41089), (CVE-2026-33825), (CVE-2026-41091), and (CVE-2026-45498).
Click to expand...
Great!

Now, how many PCs were hacked using these vulnerabilities? We don't know exactly because the data was never published. It could range from 1 to 1.5 billion PCs around the world. However, if the number was at least 500.000, it would had a comprehensive media coverage. And still, 500.000 is nothing compared to 1.5 billion.

Let's move away from the numbers, shall we? How do you get attacked using said vulnerabilities in the first place? There are only two ways; you either have malware on your PC which hacker uses to take control over PC, or you simply have a hacker in your house who physically accesses your PC. No other way.

In short, if you take care of your PC (use antivirus, regularly update software and OS and don't download or open garbage) you simply cannot get hacked. Not just because you have clean PC, but also hackers tend to attack enterprises as that's where money is. While I agree it's necessary to publish and fix found vulnerabilities, we should really stop making elephant out of a fly.
 
Last edited:
  • Like
  • Wow
  • Hundred Points
Reactions: Zero Knowledge, Khushal, Parkinsond and 2 others
Marko :) said:
Great!

Now, how many PCs were hacked using these vulnerabilities? We don't know exactly because the data was never published. It could range from 1 to 1.5 billion PCs around the world. However, if the number was at least 500.000, it would had a comprehensive media coverage. And still, 500.000 is nothing compared to 1.5 billion.

Let's move away from the numbers, shall we? How do you get attacked using said vulnerabilities in the first place? There are only two ways; you either have malware on your PC which hacker uses to take control over PC, or you simply have a hacker in your house who physically accesses your PC. No other way.

In short, if you take care of your PC (use antivirus, regularly update software and OS and don't download or open garbage) you simply cannot get hacked. Not just because you have clean PC, but also hackers tend to attack enterprises as that's where money is. While I agree it's necessary to publish and fix found vulnerabilities, we should really stop making elephant out of a fly.
Click to expand...
The way you describe how to get infected is an understatement. I don't want to spoil the thread, so I recommend you do some research on the vulnerabilities I shared.
 
Divine_Barakah said:
The way you describe how to get infected is an understatement. I don't want to spoil the thread, so I recommend you do some research on the vulnerabilities I shared.
Click to expand...
Since it's really late here and I have to work in the morning, I quickly asked Gemini (Flash Extended) for all the mentioned CVEs and what it takes to get infected.

Prompt:
What it takes to get infected by following security vulnerabilities?

CVE-2026-20805
CVE-2026-21510
CVE-2026-21513
CVE-2026-21514
CVE-2026-21519
CVE-2026-41089
CVE-2026-33825
CVE-2026-41091
CVE-2026-45498
Click to expand...

Steps it took to answer the query:
Defining the Scope
I have successfully identified the core intent: to detail infection requirements for specific CVEs.

Categorizing Vulnerabilities
I've begun categorizing the vulnerabilities and noting the requirements for each exploitation method.

Defining Attack Vectors
I've clarified the attack vectors, user interaction requirements, and access privileges needed for each vulnerability type.

Organizing CVE Details
I've successfully structured the CVEs, focusing on the conditions required for exploitation, for clarity.

Defining Infection Categories
I've categorized CVEs by attack vector, detailing infection requirements with bolded critical elements.

Categorizing Further Vulnerabilities
I have expanded the infection categories, now including further details on local access and user interaction.
Click to expand...

The final answer:
To understand what it takes to get "infected" or compromised by these security vulnerabilities, it is best to divide them into how an attacker gains leverage.
The entry requirements range from Zero-Click network attacks (highest risk), to User Interaction (phishing/social engineering), to Local Access (where malware must already be running on the machine to succeed).

1. Remote Network Attacks (Zero-Click Required)​

These are the most dangerous because they require no action from a user, and the attacker does not need any login credentials.

CVE-2026-41089 (Windows Netlogon RCE)​

  • What it takes: The target machine must be a Windows Server configured as an Active Directory Domain Controller and be network-accessible to the attacker.
  • The Attack: The attacker sends a malformed CLDAP network request packet over UDP port 389. This triggers a stack-based buffer overflow in the LSASS process, instantly granting the attacker full SYSTEM-level remote code execution to take over the entire network domain.

2. User Interaction Required (Phishing & Social Engineering)​

To be infected by these, a user must be tricked into opening a file or clicking a link. However, once the user takes that single action, the exploits are designed to silently bypass standard security warnings.

CVE-2026-21514 (Microsoft Word OLE Bypass)​

  • What it takes: A user must open a specially crafted, malicious Microsoft Word document (typically sent via phishing emails).
  • The Attack: The file manipulates Word's internal XML structures to trick the application into trusting a malicious Object Linking and Embedding (OLE) payload. It completely circumvents Protected View and Mark-of-the-Web (MotW) protections, executing code without displaying standard "Enable Content" or security prompts.

CVE-2026-21510 (Windows Shell Security Feature Bypass)​

  • What it takes: A user must download and open a malicious file (such as a shortcut .lnk file) or click a specific web link delivered via social engineering.
  • The Attack: The file exploits improper handling inside Windows Shell components to execute attacker-controlled content while entirely skipping Windows SmartScreen and OS security alerts.

CVE-2026-21513 (MSHTML Framework Security Feature Bypass)​

  • What it takes: A user must visit a malicious website or view a document/email that renders content using the legacy MSHTML (Internet Explorer) engine.
  • The Attack: The network-delivered code exploits a validation failure in the MSHTML framework to break out of browser security boundaries and bypass native protections.

3. Local Access Required (Privilege Escalation & Defense Evasion)​

An attacker cannot infect a machine from the outside using these flaws alone. Instead, the attacker (or a low-privilege malware payload) must already have local execution access on the machine. These bugs are used to upgrade their control or disable security features.

CVE-2026-41091 (Microsoft Defender Link Following LPE)​

  • What it takes: An attacker or malware running with basic user privileges manipulates local file paths by creating malicious symbolic links or junctions.
  • The Attack: When the Microsoft Malware Protection Engine runs a scan and follows these rigged paths, it mishandles file access permissions, allowing the low-privilege attacker to elevate their access to SYSTEM privileges.

CVE-2026-33825 (Microsoft Defender "BlueHammer" LPE)​

  • What it takes: Local execution access on a Windows device.
  • The Attack: The attacker runs a specific proof-of-concept exploit script targeting Microsoft Defender, forcing the security software to erroneously grant the attacker's process administrative and SYSTEM level permissions.

CVE-2026-21519 (Desktop Window Manager Elevation of Privilege)​

  • What it takes: A low-privilege process already running locally on the system.
  • The Attack: The payload triggers a "type confusion" resource flaw inside the Windows Desktop Window Manager (DWM), causing the operating system to accidentally run the attacker’s code with maximum SYSTEM authorities.

CVE-2026-45498 (Microsoft Defender Antimalware Platform DoS)​

  • What it takes: The antimalware engine must process a specific malformed input file, or an attacker already on the machine must feed it a targeted command.
  • The Attack: It triggers a Denial of Service (DoS) crash in the core Microsoft Defender Antimalware Platform, effectively disabling the antivirus tool so that secondary malware can run completely undetected.

CVE-2026-20805 (Desktop Window Manager Information Disclosure)​

  • What it takes: Local program execution.
  • The Attack: A local attacker exploits DWM to read unprivileged memory segments, allowing them to peek into sensitive system information or memory addresses to map out a secondary attack.
Click to expand...

Basically what I said; you need to somehow let hacker access your PC, whether it be by downloading or opening malicious file, or some other social-engineering way. Except the first one which is zero-click and attacking Windows Server that none of us uses. Considering servers need to be public on internet and have bunch of protocols open in order to work, they are easier to hack then average home PC. Again, not a concern for any of us.
 
  • Like
Reactions: Khushal
Marko :) said:
Since it's really late here and I have to work in the morning, I quickly asked Gemini (Flash Extended) for all the mentioned CVEs and what it takes to get infected.

Prompt:


Steps it took to answer the query:


The final answer:


Basically what I said; you need to somehow let hacker access your PC, whether it be by downloading or opening malicious file, or some other social-engineering way. Except the first one which is zero-click and attacking Windows Server that none of us uses. Considering servers need to be public on internet and have bunch of protocols open in order to work, they are easier to hack then average home PC. Again, not a concern for any of us.
Click to expand...
First, I wish you a nice day at work. I appreciate you taking the time to pull the exact technical profiles for these CVEs, Marko.

I am sorry to tell u that ur conclusion relies on thret modeling oversight. What the AI did was analysing the vulnerabilities in isloation, forgetting about the exploit chaining. You cannot separate user action from local access.

I did my best to understand exploit chaining and looking the your cateogories, the hacker needs to:

1- use user-interaction like CVE-2026-21513 to gain low-privallege on the user account using a web browser.
2- Then happens the escalation. The malware inside the system triggers DWM Elevation of Privilegde (CVE-2026-21519) to gain admin privildge
3- with admin privilege, malware triggers the DoS (CVE-2026-45498) to evade the security platform and execute payloads.
 
  • Thanks
Reactions: Marko :)
Divine_Barakah said:
First, I wish you a nice day at work. I appreciate you taking the time to pull the exact technical profiles for these CVEs, Marko.
Click to expand...
Thanks. Wishing you a nice day too!
Divine_Barakah said:
I am sorry to tell u that ur conclusion relies on thret modeling oversight. What the AI did was analysing the vulnerabilities in isloation, forgetting about the exploit chaining. You cannot separate user action from local access.

I did my best to understand exploit chaining and looking the your cateogories, the hacker needs to:

1- use user-interaction like CVE-2026-21513 to gain low-privallege on the user account using a web browser.
2- Then happens the escalation. The malware inside the system triggers DWM Elevation of Privilegde (CVE-2026-21519) to gain admin privildge
3- with admin privilege, malware triggers the DoS (CVE-2026-45498) to evade the security platform and execute payloads
Click to expand...
Oh, now I see what you're thinking. Exploit stacking is usually done during highly coordinated and complex attacks, not typical ones. I wouldn't say it's very common to have exploit stacking, but I also wouldn't say these types of attacks barely exist. Those are pretty much exclusive for enterprises, not for users like you and me.

You said, and I quote:
I did my best to understand exploit chaining and looking the your cateogories, the hacker needs to:

1- use user-interaction like CVE-2026-21513 to gain low-privallege on the user account using a web browser.
Click to expand...
Isn't that exactly what I was talking about? User needs to let hackers into their PC somehow. In most cases this happens by downloading malicious and running malicious file (web, torrent, e-mail). Exceptions are zero click which can be activated without user interaction, though these types of attack are very expensive and rare. Usually reserved for high profile people, for spying reasons.

To sum everything:
– attacks (extremely) rare for users like you and me; often for businesses
– in pretty much all cases user interaction needed
– zero click attacks very expensive and reserved for special people only
 
Last edited:
  • Hundred Points
  • +Reputation
Reactions: Jonny Quest and Divine_Barakah
Marko :) said:
Thanks. Wishing you a nice day too!

Oh, now I see what you're thinking. Exploit stacking is usually done during highly coordinated and complex attacks, not typical ones. I wouldn't say it's very common to have exploit stacking, but I also wouldn't say these types of attacks barely exist. This are pretty much exclusive for enterprises, not for users like you and me.

You said, and I quote:


Isn't that exactly what I was talking about? User needs to let hackers into their PC somehow. In most cases this happens by downloading malicious and running malicious file (web, torrent, e-mail). Exceptions are zero click which can be activated without user interaction, though these types of attack are very expensive and rare. Usually reserved for high profile people, for spying reasons.

To sum everything:
– attacks (extremely) rare for users like you and me; often for businesses
– in pretty much all cases user interaction needed
– zero click attacks very expensive and reserved for special people only
Click to expand...
I agree to a great extent.

But let's not forget about Piriform incedent and also the incident of CPU-Z
 
  • Like
Reactions: Marko :)
Divine_Barakah said:
I agree to a great extent.

But let's not forget about Piriform incedent and also the incident of CPU-Z
Click to expand...
Of course. These were different types of attacks though. I'm talking about vulnerabilities in Windows per se, not the third party software.
Victor M said:
Hacking attacks are not so rare as you think. Ask @Zero Knowledge , he has experienced some. And a few years ago I have experienced some.
Click to expand...
No one said they are rare. What I said is hackers don't attack individual users (this is rare); they attack companies offering products and services. You can become a victim through any kind of software, doesn't have to be Windows. This is why I practice philosophy "the less is better". The less software you have installed on your PC, the less chances are you'll become a victim of hacking attack.
 
  • +Reputation
  • Wow
  • Like
Reactions: Zero Knowledge, Victor M, Jonny Quest and 1 other person
Victor M said:
Hacking attacks are not so rare as you think. Ask @Zero Knowledge , he has experienced some. And a few years ago I have experienced some.
Click to expand...
LOL 🤪 Yeah I've seen my fair share but these are the ones I notice, the ones I don't are more concerning because they are good hacks by the men in black or metal tshirts.
Untitled.jpg

Untitled2.jpg

Untitled3.jpg
Untitled4.jpg
I guess someone 😍🥰 me! Or maybe I'm a bit paranoid. Oh well time to drink up 🍷:emoji_beer:🍹🥂🍺🍻🍸🍾🍾🍾

THEY also hate Kaspersky and especially KVRT, I guess because they actually make good :cool: software
 
Last edited by a moderator:
  • Thanks
Reactions: Divine_Barakah and Victor M
Marko :) said:
No one said they are rare. What I said is hackers don't attack individual users (this is rare); they attack companies offering products and services. You can become a victim through any kind of software, doesn't have to be Windows. This is why I practice philosophy "the less is better". The less software you have installed on your PC, the less chances are you'll become a victim of hacking attack.
Click to expand...
In the age of crypto this is very untrue, your kidding yourself if you think individual users are not targeted. If your high profile, have money or a huge amount of social media followers then you are very much a target. And we haven't even talked about intelligence agency or government hacking which is massive these days, just having certain views can make you a target in any country. Hell even Linux forum users were tracked and attacked back in the day because they were deemed extremists.
 
  • Like
Reactions: Parkinsond, Victor M and Divine_Barakah

You may also like...