NewsBite analysis · Security
BleepingComputer
Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges
The security researcher Nightmare Eclipse has unveiled a new zero-day vulnerability in Microsoft Defender, referred to as 'RoguePlanet'. This exploit takes advantage of a race condition in Microsoft Defender, allowing adversaries to execute commands with SYSTEM privileges on fully patched Windows devices. The exploit's proof-of-concept has been shared publicly, raising alarms about the security reliability of Microsoft software. The researcher has had previous run-ins with Microsoft over exploit disclosures, highlighting an ongoing feud within the cybersecurity landscape.
Act nowConfidence: HighImmediate horizonCybersecurity risk: High
Published 10 Jun 2026, 00:50 UTC3 min read
Visit original article ↗Lead image — BleepingComputer
Summary
TL;DR
- RoguePlanet zero-day affects Windows 10 and 11 systems.
- It exploits a race condition to grant SYSTEM privileges.
- The researcher previously faced challenges in sharing exploits with Microsoft.
- ThreatLocker confirmed the exploit’s effectiveness on patched Windows systems.
- The vulnerability is tied to Microsoft Defender's handling of SMB shares.
Interesting facts
- The exploit is a part of the ongoing conflict between Nightmare Eclipse and Microsoft over vulnerability handling.
- RoguePlanet might still have potential scenarios for remote code execution.
- The researcher has a history of releasing multiple Windows zero-days.