Microsoft Defender Discovers New Talent: Letting Hackers In
A security researcher has published details of a new zero-day vulnerability in Microsoft Defender.
In a stunning display of versatility, Microsoft's security software has once again expanded its feature set to include "granting attackers full system access." Microsoft has graciously acknowledged this bonus feature and promises - and this time they really mean it - to remove it.
A security researcher going by the name "Nightmare Eclipse" has published details of a new zero-day vulnerability in Microsoft Defender. Dubbed "Rogue Planet" (CVE-2026-50656), the flaw affects fully patched Windows 10 and Windows 11 systems and allows attackers to spawn a command prompt with SYSTEM privileges through a race condition in Defender's Malware Protection Engine.
Yes, you read that correctly. The security software. Is the vulnerability.
Microsoft Responds with Customary Urgency
In a statement delivered to Bleeping Computer with the calm confidence of someone who has done this many times before, a Microsoft spokesperson said:
"Microsoft is aware of a privilege escalation in the Microsoft Malware Protection Engine of Microsoft Defender publicly referred to as 'RoguePlanet.' We are working to provide a high-quality security update that addresses this vulnerability. We will provide information on this CVE once the update is available."
Translation: we know. We're working on it. No, we won't say when. Please enjoy your fully patched, completely vulnerable PC in the meantime.
The statement notably does not include the words "soon," "urgently," or "perhaps we should have caught this one ourselves."
The Irony, Fully Patched
The crowning detail of this story is that "Rogue Planet" affects fully patched Windows systems. Not systems that skipped updates. Not legacy machines running Windows 7 in a basement somewhere. Machines that did everything right, diligently installed every cumulative update, and were rewarded with a SYSTEM-level backdoor in their antivirus software.
To be fair to Microsoft, the race condition means exploit success is not guaranteed. On some machines it works 100% of the time. On others, less so. Which is the kind of variability you really want in a flaw that hands attackers the keys to your computer.
What You Can Do
Microsoft advises users to wait for the patch, which will arrive at an unspecified point in the future. In the meantime, security experts broadly recommend continuing to use Microsoft Defender, because the alternatives are worse. Probably. Hopefully.
about author
