Microsoft Confirms RoguePlanet, a Defender 0-Day Dropped by a Feuding Researcher

A week after an exploit for a flaw called RoguePlanet went public, Microsoft has confirmed the bug, assigned it a CVE, and said a fix is on the way. The vulnerability, tracked as CVE-2026-50656, affects Microsoft Defender and can hand an attacker full control of a Windows machine.

What RoguePlanet does

The flaw was disclosed shortly after June's patches by a researcher who goes by Nightmare Eclipse (also known as Chaotic Eclipse), along with a proof-of-concept exploit. According to the researcher, it works even on fully updated Windows 10 and Windows 11 and allows privilege escalation to SYSTEM, the highest level on the operating system.

At its core is a race condition in Microsoft Defender. A successful exploit lets an attacker open a command prompt with SYSTEM privileges and run arbitrary code. The researcher cautioned that reliability depends on the machine: on some it fires almost every time, while on others it takes several attempts.

Microsoft acknowledges the bug, but not the finder

After the disclosure, Microsoft first said it was investigating and checking whether the flaw could be exploited in practice. It has now officially recognized the problem and issued a security advisory, though it did not name Nightmare Eclipse as the person who found it. The company said it is aware of an elevation-of-privilege issue in the Microsoft Malware Protection Engine, publicly known as RoguePlanet, and that it is working on a security update to fix it.

A researcher at war with Microsoft

RoguePlanet is the latest round in a long-running feud between the researcher and Microsoft. Back in the spring, Nightmare Eclipse promised to release a fresh 0-day after every Patch Tuesday, and has been keeping that promise ever since.

In recent months the researcher has published exploits for several Windows zero-days, including BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma (CVE-2026-45586), MiniPlasma (CVE-2020-17103) and GreatXML. Some hit Defender, while others targeted BitLocker and various Windows components.

Threats, takedowns, and a protest

Nightmare Eclipse says the disclosures are a protest against how the Microsoft Security Response Center (MSRC) treats security researchers. By his account, Microsoft threatened him and promised to "ruin his life," ignored his vulnerability reports, revoked his MSRC account access, and had his exploit repositories pulled from GitHub and GitLab. He now publishes on his own infrastructure.

Microsoft, for its part, has criticized the practice of releasing exploits for unpatched flaws and warned of possible legal consequences for anyone whose actions harm users, comments that many in the security community read as a veiled threat. The company later said it does not intend to go after security researchers.

Some flaws already fixed

Not every bug from the researcher is still open. In June's Patch Tuesday, Microsoft engineers fixed GreenPlasma, MiniPlasma and YellowKey. RoguePlanet now joins the queue for a patch of its own.

Based on public reporting and statements from Microsoft and the researcher.