From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services
Mentions the CVE; no further detail.
CVE-2026-50656 Public exploit High · 7.8 EPSS 11.2%
Microsoft Defender Elevation of Privilege Vulnerability
Microsoft · Microsoft Malware Protection Engine
Summary
Microsoft Malware Protection Engine, the component within Microsoft Defender, contains an elevation of privilege flaw involving improper link resolution before file access, which allows symbolic link following. An attacker with low-privileged local access can exploit it without any user interaction to gain elevated privileges and affect the confidentiality, integrity, and availability of the system.
Official description · CVE.org
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
42.4 / 100
- Exploited
- Not confirmed
- Reports
- 7
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) was available 6 days before disclosure.
- First dated threat reportarcticwolf.com11 mo before
- Public exploit codePoC-in-GitHub6 days before
- Disclosedday 0
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Named in 7 threat reports7 reportsarcticwolf.com5anomali.com2Jul 2025 – Jun 2026 · 4 undated
Reports are matched by finding the exact id CVE-2026-50656 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Token Bingo: Don't Let Your Code be the Winner
Mentions the CVE; no further detail.
Dropping Elephant APT Group Targets Turkish Defense Industry With New Campaign and Capabilities: LOLBAS, VLC Player, and Encrypted Shellcode
Mentions the CVE; no further detail.
Rocke Evolves Its Arsenal With a New Malware Family Written in Golang
Uses Decentralized Infrastructure to Evade Takedown Efforts, ShieldBreak: Researcher Publishes Patch Bypass Claim for Microsoft Defender Zero-Day CVE-2026-50656, Zoom Patches High-Severity Annotation Vulnerabilities Enabling Remote Code Execution Across Multiple Product Lines, Autonomous Multi-Agent AI…
Show all 7 reportsShow fewer
China-Based APT Mustang Panda Targets Minority Groups, Public and Private Sector Organizations
Uses Decentralized Infrastructure to Evade Takedown Efforts, ShieldBreak: Researcher Publishes Patch Bypass Claim for Microsoft Defender Zero-Day CVE-2026-50656, Zoom Patches High-Severity Annotation Vulnerabilities Enabling Remote Code Execution Across Multiple Product Lines, Autonomous Multi-Agent AI…
Blog | Arctic Wolf
Mentions the CVE; no further detail.
Ending Cyber Risk with Aurora Endpoint Security
Mentions the CVE; no further detail.
Also mentioned in 16 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Dark Caracal Reloaded: New Malware, Same Hunting Grounds14 Sep 2026
- Dark Caracal Reloaded: New Malware, Same Hunting Grounds27 Aug 2026
- Dark Caracal Reloaded: New Malware, Same Hunting Grounds26 Aug 2026
- EbeeJuly2026 Pt16 Jul 2026
- Klue Supply Chain Compromise and CRM Data Exfiltration Incident Advisory .1 Jul 2026
- Fortinet FortiBleed Global Compromise & Active Exploitation of Fortinet Vulnerabilities.1 Jul 2026
- 10 more on OTX