Microsoft Malware Protection Engine (Microsoft Defender)

CVE-2026-50656 – Privilege Escalation via Race Condition and Improper Link Resolution (RoguePlanet)

Affects

• Microsoft Malware Protection Engine (mpengine.dll)
• Microsoft Defender (antivirus/antimalware solution using the affected engine)
• Microsoft Edge (Chromium-based) (versions prior to 150.0.4078.50, as it uses the engine)

Affected Versions:

• Microsoft Malware Protection Engine versions prior to 1.1.26060.3008

Platforms Impacted:

• Windows 10
• Windows 11 (including 25H2 and Canary channel)
• Windows Server 2025
• Windows Server editions (including Windows Server 2025)

NOT VULNERABLE:

• Systems with Microsoft Defender disabled
• Microsoft Malware Protection Engine version 1.1.26060.3008 and later
• Systems with the ShieldBreak bypass remain vulnerable even after applying the patch (see details below)

Description

CVE-2026-50656, known as “RoguePlanet” , is a high-severity local privilege escalation vulnerability in the Microsoft Malware Protection Engine. The flaw was initially discovered and publicly disclosed by security researcher Chaotic Eclipse (alias Nightmare Eclipse) in June 2026 .

The vulnerability is a race condition and improper link resolution issue that allows a local attacker with standard, low-privilege access to escalate privileges to NT AUTHORITY\SYSTEM . The attack exploits how Microsoft Defender handles file system operations, particularly during quarantine processes.

Attack Mechanism (RoguePlanet):
The flaw involves a race condition and improper link resolution (CWE-59) in how Defender processes files . An attacker can manipulate file system operations, using techniques like symbolic links or virtual disks, to trick the Defender quarantine process into overwriting critical system files. This allows the attacker to achieve SYSTEM-level code execution .

The issue was remediated in Microsoft Malware Protection Engine version 1.1.26060.3008, released in early July 2026 . Microsoft noted that the vulnerability has not been confirmed as exploited in the wild, though the public availability of a PoC increases the risk .

Patch Bypass (ShieldBreak):
On August 12, 2026, the same researcher published a new exploit chain called “ShieldBreak,” which bypasses the RoguePlanet patch . This indicates that the original fix did not fully address the underlying vulnerability and that Defender remains exploitable in specific scenarios .

ShieldBreak uses a different technique, involving the Cloud Filter API (cfapi) . It manipulates file contents during a Defender cloud-hydration scan using a user-mode callback hook, effectively changing file content as Defender is analyzing it . Microsoft has confirmed it is investigating the bypass .

Key technical characteristics:

• CWE: CWE-59 – Improper Link Resolution Before File Access (‘Link Following’)
• Attack vector: Local
• Authentication required: Yes (attacker must have local user access)
• User interaction: None
• Attack complexity: Low

Attack Vector

Primary Attack Vector:
Local (requires authenticated local user access to the system)

Attack Scenario:

1. An attacker obtains a low-privileged account or code execution on a target Windows system (e.g., via phishing, malware, or other initial access).
2. The attacker runs the crafted exploit code (RoguePlanet or ShieldBreak) on the local system.
3. The exploit triggers the race condition or improper link resolution in the Microsoft Malware Protection Engine.
4. This allows the attacker to escalate privileges to NT AUTHORITY\SYSTEM.
5. With SYSTEM privileges, the attacker can:
   • Disable or tamper with security controls (including Defender itself)
   • Install malware or backdoors for persistence
   • Steal sensitive data
   • Move laterally across the network

Key Characteristics:

Conditions Affecting Risk:

• Microsoft Defender must be enabled on the target system
• Local user access is a prerequisite
• Default configurations are vulnerable

Impact

Successful exploitation allows a local unprivileged attacker to:

• Escalate privileges to SYSTEM (the highest level of access in Windows)
• Disable or bypass security protections such as Microsoft Defender itself
• Gain full control over the compromised Windows system
• Install persistent backdoors
• Steal sensitive data
• Use the compromised system for lateral movement within the enterprise network

Observed Exploitation & Threat Activity

• Discovery: Chaotic Eclipse (aka Nightmare Eclipse)
• RoguePlanet PoC Published: June 2026
• Official RoguePlanet Patch: July 8-9, 2026 (Engine v1.1.26060.3008)
• ShieldBreak Bypass Published: August 12, 2026
• ShieldBreak Impact: Affects fully patched Windows systems (Windows 11 25H2/Canary, Windows Server 2025)
• ShieldBreak Success Rate: Reported as 100% on tested platforms
• In-the-Wild Exploitation: Not confirmed for the original CVE . The ShieldBreak bypass is considered a highly critical and imminent threat.
• Public PoC: Yes – available for both the original vulnerability and the bypass .
• CVSS Score: 7.8 (High)

Severity & Metrics

• CVSS v3.1: High (7.8)
• Attack Vector: LOCAL
• Attack Complexity: LOW
• Privileges Required: LOW
• User Interaction: NONE
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH

Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Additional Metrics:

• EPSS Score: ~10.75% (as of August 2026)

Relevant CWE:

• CWE-59 – Improper Link Resolution Before File Access (‘Link Following’)
• CWE-362 – Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’)

Patch & Vendor Status

• Official Patch for RoguePlanet: Yes – Microsoft Malware Protection Engine version 1.1.26060.3008 (released July 2026)
• Update Mechanism: The update is distributed automatically via Windows Update and Microsoft Defender definition updates. No user action is required to install the update .
• Patch Status for ShieldBreak: No official fix available as of August 2026 . Microsoft has confirmed it is investigating the bypass .
• Vendor: Microsoft Corporation

Fixed Version (RoguePlanet Only):

Microsoft Statement:

“Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as ‘RoguePlanet’. We are working to provide a high quality security update that addresses this vulnerability.”
“We are aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims.” (regarding ShieldBreak)

Mitigation & Remediation

Immediate Actions

Verification:
Check the Microsoft Malware Protection Engine version via Microsoft Defender’s “About” section or the registry. Versions prior to 1.1.26060.3008 are vulnerable .

Short-Term Defensive Measures

Since no official fix is available for ShieldBreak, Microsoft recommends the following temporary mitigations :

• Block execution of vulnerable Defender binaries/apps using Defender Vulnerability Management or EDR policies .
• Restrict local administrative rights to reduce available privilege for local attackers .
• Enforce application allowlisting to limit execution of untrusted local binaries .
• Enable Tamper Protection and least-privilege controls for Defender .

Long-term Defensive Measures

• Deploy and test Attack Surface Reduction (ASR) rules (use audit mode first, then move to block mode) .
• Enable runtime detection (e.g., eBPF-based tools) for unusual Defender activity .
• Regularly review audit trails for MsMPEng.exe and User Profile Service events, focusing on child process creation, token duplication, junction/symlink, and hive mounting behaviors .

Detection & Monitoring

Recommended Detection Sources:

Indicators of Attempted Exploitation:

• Unexpected SYSTEM-level processes or command shells
• Anomalous behavior from the Microsoft Defender process (MsMPEng.exe), such as child process creation
• Changes to Microsoft Defender settings or services
• Unusual file system operations involving symbolic links, junctions, or virtual disks
• Suspicious scheduled tasks or service creations

Detection Queries:
Security researcher Kevin Beaumont has published hunting queries for ShieldBreak, which can help defenders rapidly find signs of exploitation .

Post-Incident Response

If exploitation is suspected:

1. Isolate affected system from the network immediately.
2. Preserve forensic evidence (system logs, process history, file system changes, network captures).
3. Identify the source of local access used for exploitation.
4. Rotate all credentials stored on the compromised system (SSH keys, application secrets, user passwords).
5. Audit for backdoors – Check:
   • SYSTEM-level processes
   • Scheduled tasks
   • Windows services
   • Registry modifications
   • Modified system files
   • Unauthorized user accounts
6. Assume full compromise – SYSTEM-level access means the attacker could have modified any system component.
7. Rebuild system from a trusted, clean installation.
8. Apply all available patches and mitigations before reconnecting to the network.
9. Extend investigation to any systems accessible from the compromised host.

For Enterprise Environments:

• Immediately deploy the RoguePlanet patch and the temporary phoneinfo.dll mitigation .
• Deploy the hunting queries provided by Kevin Beaumont to detect ShieldBreak .
• Implement layered compensating controls and behavioral monitoring as described in the mitigation section.

References

• https://www.cve.org/CVERecord?id=CVE-2026-50656
• https://nvd.nist.gov/vuln/detail/CVE-2026-50656
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656
• https://git.churchofmalware.org/Nightmare_Eclipse/RoguePlanet
• https://thehackernews.com/2026/07/microsoft-patches-rogueplanet-defender.html
• https://vuldb.com/vuln/371364
• https://aviatrix.ai/threat-research-center/shieldbreak-zero-day-poc-claims-microsoft-defender-patch-bypass-with-system-access/
• https://cwe.mitre.org/data/definitions/59.html