Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Microsoft Defender RoguePlanet race-condition zero-day remote code execution flaw

Vulnerability
First reported
Last updated
Happening score
H score 39
2 unique sources, 2 articles

Summary

Hide ▲

Microsoft Defender zero-day RoguePlanet is a race-condition flaw affecting fully patched Windows 10 and Windows 11 systems. A public proof-of-concept exploit was released shortly after June 2026 Patch Tuesday and can spawn a SYSTEM-level command prompt or shell when exploitation succeeds. Later reporting added that the exploit was reproduced on fully patched Windows 11 with KB5094126 and that the issue was originally aimed at remote code execution over SMB-hosted files, though the released proof of concept is mainly described as local privilege escalation. The later disclosure also says the exploit has been tested on Windows 10 and Windows 11 with June 2026 updates and does not yet work on Windows Server without redesign.

Related Happenings

Microsoft Defender update-blocking disk exhaustion security flaw

Vulnerability
H score28 First: 22.09.2026 19:14 Last: 22.09.2026 19:14 Sources 1

About this happening: BigDiskBuster exposes a Microsoft Defender flaw that can block platform and signature updates by exhausting disk space, leaving detection content stale on affected Win...

Open Happening

Microsoft Defender update-blocking zero-day security flaw

Vulnerability
H score7 First: 22.09.2026 12:55 Last: 22.09.2026 12:55 Sources 1

About this happening: A Microsoft Defender zero-day named BigDiskBuster can block platform/signature updates on supported Windows versions, freezing antivirus updates while it runs in t...

Open Happening

Microsoft Defender SYSTEM privilege escalation bypass (CVE-2026-69414)

Vulnerability
H score28 First: 09.09.2026 10:30 Last: 09.09.2026 10:30 Sources 1

About this happening: Microsoft Defender vulnerability CVE-2026-69414 is back in focus after Chaotic Eclipse released ShieldCrash, a patch bypass for ShieldBreak. The PoC shows...

Open Happening

Microsoft Defender Antivirus false 'turned off' alerts after latest updates

Security Tool/Service
H score11 First: 31.08.2026 11:29 Last: 31.08.2026 11:29 Sources 1

About this happening: Microsoft Defender Antivirus is showing false 'turned off' alerts after the latest updates, creating confusion on supported Windows client and server systems even though p...

Latest development: 18.09.2026 15:16

Microsoft fixed the Defender Antivirus false-status alert issue in Microsoft Defender Antivirus update version 4.18.26080.4, released on September 17. The update addresses erroneous Windows Security app notifications that said "Microsoft Defender Antivirus is turned off" even though protection remained active, across supported Windows client and server versions including Windows 11 26H1 and Windows Server 2025.

Open Happening

Microsoft Defender signature update fixes scan-crash bug on Windows 10 and Windows 11

Security Tool/Service
H score11 First: 19.08.2026 14:14 Last: 19.08.2026 14:14 Sources 1

About this happening: Microsoft Defender now has a fix for a crash bug that broke scans on some Windows 10 and Windows 11 systems, restoring malware protection after a recent security updat...

Open Happening

Timeline

  1. 10.06.2026 08:22 2 articles · 4mo ago

    Chaotic Eclipse releases RoguePlanet proof-of-concept exploit for Microsoft Defender

    Initial Disclosure

    The anonymous security researcher Chaotic Eclipse, also known as Nightmare-Eclipse, released a proof-of-concept (PoC) exploit for the Microsoft Defender zero-day RoguePlanet under a new GitHub account named MSNightmare. The race-condition exploit can yield a SYSTEM-level shell and arbitrary code execution when it succeeds, has been tested on Windows 11 and Windows 10 with the June 2026 Patch Tuesday updates installed, and currently does not work on Windows Server without redesign because standard users cannot mount an ISO image.

    Show sources
    Open in new tab
  2. 10.06.2026 02:11 2 articles · 4mo ago

    Nightmare Eclipse releases RoguePlanet Microsoft Defender exploit

    Initial Disclosure

    Nightmare Eclipse releases the RoguePlanet proof-of-concept as a Microsoft Defender race-condition exploit that can spawn a command prompt with SYSTEM privileges on fully patched Windows 10 and Windows 11 systems.

    Show sources
    Open in new tab
  3. 10.06.2026 02:11 1 articles · 4mo ago

    ThreatLocker reproduces RoguePlanet on fully patched Windows 11

    Technical Analysis Update

    ThreatLocker reproduces RoguePlanet against fully patched Windows 11 systems with KB5094126 installed and says application allowlisting can prevent the exploit from executing.

    Show sources
    Open in new tab