{"id":"CVE-2026-50656","published":"2026-06-16T18:01:33Z","modified":"2026-09-24T13:44:14Z","title":"Microsoft Defender Elevation of Privilege Vulnerability","vendor":"Microsoft","product":"Microsoft Malware Protection Engine","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"Microsoft Malware Protection Engine","versions":[">= 1.1.0.0, < 1.1.26060.3008"]}],"description":{"text":"Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as &quot;RoguePlanet &quot;.","provenance":"source","from":"CVE.org"},"summary":{"text":"Microsoft Malware Protection Engine, the component within Microsoft Defender, contains an elevation of privilege flaw involving improper link resolution before file access, which allows symbolic link following. An attacker with low-privileged local access can exploit it without any user interaction to gain elevated privileges and affect the confidentiality, integrity, and availability of the system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:29Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.11163,"percentile":0.95942,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":16,"pulses":[{"name":"Dark Caracal Reloaded: New Malware, Same Hunting Grounds","url":"https://otx.alienvault.com/pulse/6aa78a3264f244d220fb0674","created":"2026-09-14"},{"name":"Dark Caracal Reloaded: New Malware, Same Hunting Grounds","url":"https://otx.alienvault.com/pulse/6a901a11aa953b033920222a","created":"2026-08-27"},{"name":"Dark Caracal Reloaded: New Malware, Same Hunting Grounds","url":"https://otx.alienvault.com/pulse/6a8f1fe07f5ffb26e71db532","created":"2026-08-26"},{"name":"EbeeJuly2026 Pt1","url":"https://otx.alienvault.com/pulse/6a4b3cc2ebf14a6ed2559ae1","created":"2026-07-06"},{"name":"Klue Supply Chain Compromise and CRM Data Exfiltration Incident Advisory .","url":"https://otx.alienvault.com/pulse/6a453e4304340bbf7c2784f0","created":"2026-07-01"},{"name":"Fortinet FortiBleed Global Compromise & Active Exploitation of Fortinet Vulnerabilities.","url":"https://otx.alienvault.com/pulse/6a453afe4aa12955b2b60fe5","created":"2026-07-01"},{"name":"New IT Support in Town.","url":"https://otx.alienvault.com/pulse/6a4528153308767de68b518b","created":"2026-07-01"},{"name":"Active Exploitation of Oracle PeopleSoft Environment Management.","url":"https://otx.alienvault.com/pulse/6a45269dfdb4f553b17ed178","created":"2026-07-01"},{"name":"Check Point VPN Authentication Bypass Under Active Exploitation.","url":"https://otx.alienvault.com/pulse/6a4525e56877a3374b6b3c22","created":"2026-07-01"},{"name":"Known_Cve | Jun 25, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a3be6dbb1f7cc62068aef9a","created":"2026-06-24"}],"provenance":"machine"},"cwes":[{"id":"CWE-59","name":"Improper Link Resolution Before File Access"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656","tags":["vendor-advisory","patch"]},{"url":"https://github.com/MSNightmare/ShieldBreak","tags":["exploit"]}],"techniques":[],"reports":[{"id":"SRC-785c287ab8311e1ba46a","title":"From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services","publisher":"arcticwolf.com","url":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/","date":"2026-06-02","mentions":[{"quote":"12, 2026Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass","start":5192,"end":5492}]},{"id":"SRC-6a06d5ec9ab99e8b6b36","title":"Token Bingo: Don't Let Your Code be the Winner","publisher":"arcticwolf.com","url":"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/","date":"2026-04-24","mentions":[{"quote":"12, 2026Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass","start":5102,"end":5402}]},{"id":"SRC-876a8c22e3a8316f7dab","title":"Dropping Elephant APT Group Targets Turkish Defense Industry With New Campaign and Capabilities: LOLBAS, VLC Player, and Encrypted Shellcode","publisher":"arcticwolf.com","url":"https://arcticwolf.com/resources/blog/dropping-elephant-apt-group-targets-turkish-defense-industry/","date":"2025-07-23","mentions":[{"quote":"12, 2026Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass","start":5196,"end":5496}]},{"id":"SRC-e6ea51cbb7425b65e313","title":"Rocke Evolves Its Arsenal With a New Malware Family Written in Golang","publisher":"anomali.com","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang","date":null,"mentions":[{"quote":"Uses Decentralized Infrastructure to Evade Takedown Efforts, ShieldBreak: Researcher Publishes Patch Bypass Claim for Microsoft Defender Zero-Day CVE-2026-50656, Zoom Patches High-Severity Annotation Vulnerabilities Enabling Remote Code Execution Across Multiple Product Lines, Autonomous Multi-Agent AI","start":22268,"end":22571}]},{"id":"SRC-4cf3172d190519e868ee","title":"Blog | Arctic Wolf","publisher":"arcticwolf.com","url":"https://arcticwolf.com/resources/blog/","date":null,"mentions":[{"quote":"12, 2026Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass","start":5060,"end":5360},{"quote":"Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)","start":8102,"end":8220}]},{"id":"SRC-30fea94800a22b71dd78","title":"China-Based APT Mustang Panda Targets Minority Groups, Public and Private Sector Organizations","publisher":"anomali.com","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations","date":null,"mentions":[{"quote":"Uses Decentralized Infrastructure to Evade Takedown Efforts, ShieldBreak: Researcher Publishes Patch Bypass Claim for Microsoft Defender Zero-Day CVE-2026-50656, Zoom Patches High-Severity Annotation Vulnerabilities Enabling Remote Code Execution Across Multiple Product Lines, Autonomous Multi-Agent AI","start":23642,"end":23945}]},{"id":"SRC-1b0b8c4d77ff85ee9833","title":"Ending Cyber Risk with Aurora Endpoint Security","publisher":"arcticwolf.com","url":"https://arcticwolf.com/cylance/","date":null,"mentions":[{"quote":"12, 2026Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass","start":5103,"end":5403}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-37141","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-37141","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":0,"earliest":"2026-06-10","earliestUrl":"https://github.com/g0thamRabb1t/CVE-2026-50656-rogueplanet-validation","repos":[{"name":"0xBlackash/CVE-2026-50656","url":"https://github.com/0xBlackash/CVE-2026-50656","stars":10,"created":"2026-06-18"},{"name":"g0thamRabb1t/CVE-2026-50656-rogueplanet-validation","url":"https://github.com/g0thamRabb1t/CVE-2026-50656-rogueplanet-validation","stars":2,"created":"2026-06-10"},{"name":"eh-amish/Windows-Defender-Security-Auditor-CVE-2026-50656-","url":"https://github.com/eh-amish/Windows-Defender-Security-Auditor-CVE-2026-50656-","stars":1,"created":"2026-08-16"},{"name":"HORKimhab/CVE-2026-50656","url":"https://github.com/HORKimhab/CVE-2026-50656","stars":0,"created":"2026-08-12"}]},"first":{"date":"2026-06-10","source":"PoC-in-GitHub","url":"https://github.com/g0thamRabb1t/CVE-2026-50656-rogueplanet-validation"},"provenance":"source"},"exploitRefs":["https://github.com/MSNightmare/ShieldBreak"],"flow":[],"timeline":[{"date":"2025-07-23","kind":"report","label":"Named in arcticwolf.com: Dropping Elephant APT Group Targets Turkish Defense Industry With New Campaign and Capabilitie…","url":"https://arcticwolf.com/resources/blog/dropping-elephant-apt-group-targets-turkish-defense-industry/","provenance":"machine"},{"date":"2026-04-24","kind":"report","label":"Named in arcticwolf.com: Token Bingo: Don't Let Your Code be the Winner","url":"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/","provenance":"machine"},{"date":"2026-06-02","kind":"report","label":"Named in arcticwolf.com: From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook,…","url":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/","provenance":"machine"},{"date":"2026-06-10","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/g0thamRabb1t/CVE-2026-50656-rogueplanet-validation","provenance":"source"},{"date":"2026-06-16","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-50656","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":42.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.19,"detail":"percentile 0.9594"},{"name":"Named in threat reports","points":10.0,"detail":"7 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.79,"detail":"16 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}