A race condition in the Microsoft Malware Protection Engine, the scanning core of Microsoft Defender, lets an attacker with a foothold on a standard Windows account spawn a command shell running with SYSTEM privileges, the highest level of access on the operating system, even on a fully patched machine. Microsoft is tracking the flaw as CVE-2026-50656 and has publicly acknowledged it under the name “RoguePlanet.”
Microsoft’s own advisory describes the issue as an elevation of privilege vulnerability in the Malware Protection Engine, assigns it a CVSS 4.0 base score of 7.8, and rates exploitation “more likely” on its Exploitability Index. The company says it is working on a security update and has not yet shipped a fix as of this writing. The flaw affects Windows 10 and Windows 11 devices regardless of whether Defender’s active protection is enabled, so disabling the antivirus component is not a workaround.
The detail that should concern security leaders most is where the bug lives. RoguePlanet does not exploit a gap in Defender’s coverage; it exploits the scanning engine itself, the exact component organizations rely on to catch privilege escalation attempts in the first place. That inverts the usual defensive assumption that endpoint security tooling is part of the trusted base rather than part of the attack surface. It also means an attacker who has already compromised a low privileged account does not need a separate escalation technique. They can use the very software watching for one.
This is not the first time Defender’s own code has been the entry point rather than the safeguard. CyberTech previously covered Microsoft’s out-of-band patches for two actively exploited Defender zero-days, and RoguePlanet extends that pattern into the current quarter. Until Microsoft ships a fix, security teams should tighten local account privileges, monitor for anomalous SYSTEM level shell spawns tied to the Malware Protection Engine process, and treat endpoint detection and response alerts around Defender’s own scanning activity as high priority rather than routine noise.
