An active exploit code for CVE-2026-50656, a high-severity local privilege escalation flaw in the Microsoft Malware Protection Engine, is being sold on dark web forums. Learn how the RoguePlanet exploit works and how to protect your enterprise Windows systems.
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
A threat actor is auctioning a zero-day exploit targeting an undisclosed WordPress plugin with over 10,000 active installations. The vulnerability allows low-privileged users with the create_users capability to escalate to Administrator, leading to full site takeover. Discover detection and containment strategies.
An alleged sale of unpatched critical zero-day exploits targeting Floci, Gitea, libssh, and c-ares highlights a growing threat. While the zero-day claims on dark web forums are likely fraudulent, the weaponization of legitimate public research repositories poses an immediate risk to enterprise networks.
June 19, 2026
A reported zero-day exploit targeting Local Privilege Escalation (LPE) in Windows presents a significant risk to enterprise security, potentially allowing attackers to elevate permissions and compromise system integrity.
Defenders must immediately audit the operational version of the Microsoft Malware Protection Engine (MMPE) across all endpoints to mitigate a newly traded local privilege escalation exploit. Known publicly as RoguePlanet and tracked under CVE-2026-50656, this high-severity security flaw allows local attackers to achieve full SYSTEM-level privileges in approximately five seconds. The primary containment priority for security operations teams is validating that MMPE is updated to version 1.1.26060.3008 or higher, as earlier versions contain an architectural race condition that bypasses core anti-malware protections.
The escalation threat stems from active underground listings on Russian-language dark web forums, where threat actors are selling fully functional exploit code. This development follows a series of zero-day releases by an aggressive exploit developer operating under aliases such as Nightmare Eclipse, Chaotic Eclipse, and MSNightmare. This developer has previously released other highly complex Windows exploits without coordinated disclosure, directly exposing enterprise environments to pre-patched and zero-day vulnerabilities. Because the RoguePlanet exploit code is now commercially available in underground channels, the probability of rapid adoption by ransomware groups and advanced persistent threats (APTs) has escalated dramatically.
The technical core of CVE-2026-50656 lies in a Time-of-Check to Time-of-Use (TOCTOU) file-system race condition categorized under CWE-59 (Improper Link Resolution Before File Access, also known as link-following). The vulnerability affects the core scanning component of Microsoft Defender, mpengine.dll, in versions ranging from 1.1.26050.11 through 1.1.26060.3007. Because Microsoft Defender executes with the highest possible operating system privileges, any flaw in its file remediation and quarantine pipeline provides an immediate avenue for privilege escalation if an attacker already has local execution rights.
The RoguePlanet attack chain is highly sophisticated. It does not rely on traditional memory corruption or kernel exploits, but rather orchestrates legitimate Windows operating system features, including Volume Shadow Copies, opportunistic locks (oplocks), NTFS directory junctions, and the Windows Error Reporting framework.
The attack starts when a low-privileged local process executes the RoguePlanet binary. This binary is compiled as a self-referential executable with two distinct code paths: an unprivileged orchestrator and a privileged payload. When executed, the binary checks its current security token. Under a standard user context, it launches the orchestration routine. Once privilege escalation is achieved, the elevated process executes the same binary but switches to the SYSTEM-level payload branch, connecting back to a local named pipe to spawn an administrative shell.
Winning a TOCTOU race condition requires precise timing, which is typically unstable on modern, multi-core systems. To make the exploit highly deterministic, the orchestrator initializes an internal component called the Poseidon I/O subsystem. This subsystem launches a generator thread that produces massive amounts of random data and assigns one worker thread per CPU core to write this data to temporary files. By saturating the system scheduling queues and disk write queues, the exploit artificially widens the race window, giving the orchestrator ample time to manipulate files during Defender's scanning process.
Next, the orchestrator extracts an embedded, read-only virtual ISO image to a temporary file named with a unique identifier (UUID) and mounts it using the Windows Virtual Disk API. Crucially, it mounts the virtual disk with the flag ATTACH_VIRTUAL_DISK_FLAG_NO_DRIVE_LETTER, accessing the disk via its raw NT kernel path to bypass path restrictions and standard volume-mounting alerts. Inside this virtual ISO is a dummy file named wermgr.exe that contains the standard EICAR anti-malware test signature. Concurrently, the orchestrator sets up local temporary directories under %TEMP% to stage the attack.
The orchestrator copies the dummy EICAR-signed file to the local staging directory and appends an NTFS Alternate Data Stream (ADS) named :WDFOO. Using the Microsoft Defender RPC client interface (MpClient.dll), the orchestrator triggers an on-demand scan of this specific path. Simultaneously, the exploit queries the Volume Shadow Copy Service (VSS) to locate the raw backup path of the target file. It then places an opportunistic lock (oplock) on the shadow copy path using the FSCTL_REQUEST_OPLOCK control code. When Microsoft Defender's high-privilege service (MsMpEng.exe) attempts to read the file to perform remediation, the oplock triggers, temporarily pausing the Defender scanning thread.
While Microsoft Defender is paused by the oplock, the orchestrator acts immediately. It deletes the local staging directory handle and replaces it with an NTFS reparse point junction that points directly to the mounted virtual ISO. When the orchestrator releases the oplock, Microsoft Defender resumes execution, but its file handle now resolves to the read-only virtual ISO. Defender reads the clean, legitimate-looking executable from the ISO, believing it is processing the original quarantined file.
The orchestrator actively monitors the C:\Windows\Temp folder for the temporary quarantine file created by Defender. Once the temporary file is created, the orchestrator tears down the directory junction and gains direct write access to the newly created, SYSTEM-owned quarantine placeholder. Because Defender has already validated the file and holds an open transaction, the orchestrator is able to overwrite this temporary file with its own exploit payload while retaining the SYSTEM ownership and permissions established by the operating system.
To trigger execution of the overwritten payload, the orchestrator invokes the Task Scheduler COM API to run the built-in Windows task \Microsoft\Windows\Windows Error Reporting\QueueReporting. This task natively runs under NT AUTHORITY\SYSTEM and attempts to execute the standard wermgr.exe binary. Due to the directory junction manipulations performed by the orchestrator, the execution path is redirected to the attacker's malicious binary. The binary executes as SYSTEM, detects its elevated token, and opens a connection to the local named pipe \\.\pipe\RoguePlanet, spawning an interactive shell for the user.
The impact of CVE-2026-50656 in an enterprise network is severe. While local privilege escalation requires an attacker to already have local code execution, it is the critical pivot point in modern cyber attacks. Once an attacker gains access to a low-privilege environment through phishing, stolen credentials, or unpatched edge devices, they typically deploy LPE exploits to disable security agents, harvest credentials from memory, and deploy ransomware.
Because the Malware Protection Engine is trusted by the operating system, bypassing its integrity controls allows threat actors to execute arbitrary code with the highest level of trust. This invalidates host-based detection capabilities and allows attackers to establish persistent administrative access. Organizations must ensure that they have a robust vulnerability management process to identify and patch endpoints that are running outdated versions of core security applications.
Defenders can identify and stop RoguePlanet exploitation by combining proactive patching with behavioral detection rules.
Security operations centers should implement the following telemetry detections:
Process Execution Anomalies: Monitor for instances where wermgr.exe (Windows Error Reporting) spawns conhost.exe or cmd.exe. In normal environments, wermgr.exe does not spawn command shells.
Path Anomalies: Alert on any execution of wermgr.exe originating from user-writable directories such as %TEMP% or subdirectories of %USERPROFILE%.
Directory Junction Abuse: Monitor for high-frequency creation and deletion of directory junctions under temporary directories, especially those involving shadow copy paths or virtual storage mounts.
Named Pipe Monitoring: Create detection rules for the creation of anomalous named pipes, specifically matching \\.\pipe\RoguePlanet or other hardcoded strings used in public proof-of-concept repositories.
To verify whether your systems are vulnerable to CVE-2026-50656, execute the following PowerShell command on your Windows assets:
Get-MpComputerStatus | Select-Object AMEngineVersion, AMProductVersion, RealTimeProtectionEnabledIf the returned AMEngineVersion is less than 1.1.26060.3008, the asset is vulnerable and requires an immediate update.
To restrict standard users from exploiting this vulnerability, organizations can implement Group Policy Objects (GPOs) to disable the mounting of ISO and VHD files by non-administrative users. Since the public proof-of-concept relies heavily on mounting no-drive-letter virtual disks to evade detection, restricting this administrative capability significantly degrades the reliability of the exploit.
Furthermore, deploying robust security hygiene through regular penetration testing and continuous attack path mapping can identify weak trust boundaries where local execution could be obtained in the first place.