CVE-2026-50656 (RoguePlanet): Microsoft Defender EoP Zero-Day Patched Out-of-Band After Public PoC and Prior-Exploitation Reports

Microsoft shipped an out-of-band patch on July 8 closing RoguePlanet (CVE-2026-50656, CVSS 7.8), a race condition in the Malware Protection Engine (mpengine.dll) that allows a standard local user to spawn a SYSTEM-privileged shell — the seventh Windows zero-day dropped by researcher Nightmare-Eclipse (aka Chaotic Eclipse) amid an ongoing bug-bounty dispute with Microsoft. The PoC works regardless of whether Defender real-time protection is enabled or disabled, and Qualys claims prior in-the-wild exploitation, though Microsoft's advisory and the CISA KEV catalog do not confirm it. Defenders should verify engine version 1.1.26060.3008 or later is deployed across all endpoints, as the flaw is disproportionately useful post-initial-access for privilege escalation through the very security tooling meant to detect attackers.

The PoC works regardless of whether Defender real-time protection is enabled or disabled, and Qualys claims prior in-the-wild exploitation, though Microsoft's advisory and the CISA KEV catalog do not confirm it.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.