Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Microsoft releases RoguePlanet Defender security update for CVE-2026-50656

Security Patch Release
First reported
Last updated
Happening score
H score 32
2 unique sources, 3 articles

Summary

Hide ▲

Microsoft has released a security update for CVE-2026-50656, remediating RoguePlanet in the Microsoft Malware Protection Engine (mpengine.dll). The flaw is a privilege-escalation issue with a CVSS score of 7.8 that could let an attacker reach SYSTEM-level privileges and run arbitrary code or unauthorized actions. The fix is in Microsoft Malware Protection Engine version 1.1.26060.3008, along with additional defense-in-depth updates, and Microsoft said no customer action is required because updates are delivered automatically.

Related Happenings

Microsoft Defender BlueHammer (CVE-2026-33825) ransomware exploitation wave

Exploitation Wave
H score41 First: 30.06.2026 11:53 Last: 30.06.2026 11:53 Sources 1

About this happening: CISA has flagged BlueHammer (CVE-2026-33825) as exploited in ransomware campaigns, expanding the risk to Windows devices exposed to privilege escalation. The flaw in *...

Open Happening

Microsoft security patch release for CVE-2026-41091 and CVE-2026-45498

Security Patch Release
H score44 First: 21.05.2026 10:49 Last: 21.05.2026 10:49 Sources 1

About this happening: Microsoft rolled out security updates for Defender and related malware protection components to address two zero-days: CVE-2026-41091 and CVE-2026-45498. The fixes cover affected...

Latest development: 21.05.2026 12:52

Microsoft released patches for Microsoft Defender Antimalware Platform version 4.18.26040.7 to address CVE-2026-41091, a link-following privilege-escalation flaw that can let an authorized attacker elevate privileges locally to System, and CVE-2026-45498, a denial-of-service flaw. Microsoft said both vulnerabilities were publicly disclosed and exploited in the wild as zero-days. CISA added both flaws to its Known Exploited Vulnerabilities (KEV) list and urged federal agencies to patch them by June 3.

Open Happening

Microsoft May 2026 Patch Tuesday release

Security Patch Release
H score44 First: 13.05.2026 13:36 Last: 13.05.2026 13:36 Sources 1

About this happening: Microsoft's May 13, 2026 Patch Tuesday release fixed 138 vulnerabilities across its product portfolio, including Windows, Azure, and Edge. None of the flaws we...

Latest development: 01.06.2026 15:30

Belgium's Centre for Cybersecurity warned that CVE-2026-41089 in Windows Netlogon is being actively exploited in the wild after Microsoft patched the stack-based buffer overflow during the May 2026 Patch Tuesday. The flaw affects all currently supported Windows Server versions, including Windows Server 2025, and can let an unauthenticated attacker gain remote code execution on targeted domain controllers.

Open Happening

CISA KEV order for BlueHammer patching

Public Sector Action
H score37 First: 23.04.2026 14:05 Last: 23.04.2026 14:05 Sources 1

About this happening: CISA ordered Federal Civilian Executive Branch agencies to patch Windows systems against CVE-2026-33825 within two weeks after adding BlueHammer to the K...

Open Happening

Windows zero-day exploitation wave

Exploitation Wave
H score38 First: 17.04.2026 09:14 Last: 17.04.2026 09:14 Sources 1

About this happening: BlueHammer, RedSun, and UnDefend are being exploited in the wild against Windows devices, creating active risk of SYSTEM or elevated administrator compromise....

Latest development: 23.04.2026 14:05

CISA added BlueHammer, tracked as CVE-2026-33825, to its Known Exploited Vulnerabilities (KEV) Catalog and ordered Federal Civilian Executive Branch (FCEB) agencies to patch Microsoft Defender on Windows systems within two weeks, until May 7. The federal directive targets ongoing zero-day abuse of the flaw on U.S. government systems.

Open Happening

Timeline

  1. 09.07.2026 11:48 2 articles · 6d ago

    Microsoft releases security update for RoguePlanet in Microsoft Defender

    Mitigation Patch Update

    Microsoft released security updates for CVE-2026-50656, remediating the RoguePlanet privilege-escalation flaw in Microsoft Malware Protection Engine (mpengine.dll) with version 1.1.26060.3008 and additional defense-in-depth updates. Microsoft said no customer action is required to install the update.

    Show sources
    Open in new tab
  2. 17.06.2026 20:36 1 articles · 28d ago

    Chaotic Eclipse says RoguePlanet PoC works with real-time protection on

    Technical Analysis Update

    Chaotic Eclipse said the RoguePlanet proof-of-concept for CVE-2026-50656 still works even when real-time protection is enabled, and may also function in passive mode, underscoring the race-condition behavior described for the Microsoft Defender zero-day.

    Show sources
    Open in new tab
  3. 17.06.2026 20:36 2 articles · 28d ago

    Microsoft works on a security update for RoguePlanet in Microsoft Defender

    Initial Disclosure

    Microsoft said it is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender, publicly referred to as RoguePlanet, and is working to provide a high-quality security update for CVE-2026-50656.

    Show sources
    Open in new tab