Overview
- Microsoft released Microsoft Malware Protection Engine version 1.1.26060.3008 on Thursday, July 9, 2026, to remediate CVE-2026-50656 and add defense-in-depth hardening to related components.
- The flaw, called RoguePlanet, is a race-condition privilege-escalation in the Malware Protection Engine that a researcher showed can spawn a SYSTEM shell on fully patched Windows 10 and Windows 11 machines.
- The vulnerability was publicly disclosed in mid-June by a researcher using the names Nightmare Eclipse and Chaotic Eclipse who also published a proof-of-concept in a self‑hosted repository, and Microsoft confirmed it was working on a patch on June 16.
- Microsoft says customers do not need to take action because Defender products update the engine automatically, but security teams are advised to verify automatic update delivery in enterprise environments.
- The public release of the PoC and Microsoft’s legal warnings to people it said were causing harm have intensified a dispute over disclosure practices, following several other zero-day disclosures by the same researcher this year.