RoguePlanet: Unpatched Zero-Day in Microsoft Defender Enables…

RoguePlanet is a zero-day vulnerability in Microsoft Defender with no CVE assigned and no patch available as of June 17, 2026. It allows local privilege escalation to SYSTEM via a TOCTOU race condition on fully patched Windows 10 and 11 systems. It is the sixth or seventh zero-day in a retaliatory campaign that has already seen three prior exploits weaponized in the wild.

Microsoft is investigating a zero-day vulnerability in its built-in antivirus but has released no patch. Meanwhile, the researcher who disclosed it — after having their MSRC account revoked and repositories removed — threatens further releases. RoguePlanet, published June 10, 2026, enables local escalation to SYSTEM on fully patched Windows 10 and Windows 11. It is the sixth or seventh zero-day in a retaliatory campaign that has already seen three prior exploits exploited in real-world environments.

Key Takeaways

RoguePlanet: zero-day in Microsoft Defender, no CVE assigned, no patch as of June 17, 2026
Local SYSTEM escalation via TOCTOU race condition in MsMpEng.exe file handling
Working PoC on Windows 10/11 with June 2026 patches; independently validated by ThreatLocker with KB5094126
Originally developed as RCE via SMB/VHDX, repurposed to LPE after May 2026 Defender patch
Nightmare Eclipse campaign: 6+ zero-days since April 2026, ~10-day cadence, 3 prior exploits confirmed in the wild
Microsoft condemns public disclosures as "never justifiable"; researcher alleges retaliation

"Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims. Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible." — Microsoft spokesperson to The Hacker News

The Conflict Driving the Campaign

Nightmare Eclipse, also known as Chaotic Eclipse, released the RoguePlanet PoC via the GitHub account "MSNightmare" hours after the June 2026 Patch Tuesday. The timing is deliberate: nearly 200 vulnerabilities were fixed in that bulletin — the largest in Microsoft history — but RoguePlanet was not among them.

The researcher frames the campaign as a direct reaction to Microsoft's actions. According to The Hacker News, they allege the revocation of their MSRC account and the forced removal of repositories on GitHub and GitLab. Microsoft has denied taking legal action but has explicitly condemned public disclosures as "never justifiable." This adversarial dynamic, not merely a technical one, explains the sustained cadence: roughly ten days between releases, with six or seven zero-days since April 2026 depending on the counting method.

Three prior exploits from the same campaign — BlueHammer, RedSun, and UnDefend — have been confirmed as exploited in the wild before patches were available. For RoguePlanet, no such in-the-wild exploitation has been confirmed.

The TOCTOU Mechanic

RoguePlanet exploits a Time-of-Check to Time-of-Use race condition in the Microsoft Defender engine. The MsMpEng.exe process, running with SYSTEM privileges, validates a file path before performing write or removal operations. In the interval between check and action, a local attacker replaces the target via an NTFS junction or symbolic link.

Defender then writes attacker-controlled content to protected locations. Picus Security describes the anomaly as a suspicious parent-child pattern: MsMpEng.exe spawning system-level processes in an unusual manner. The inherent nature of the race condition makes exploit reliability variable.

"The exploit is a race condition, so it's a matter of luck... I managed to get a 100% success rate on some machines, while on others it struggled to work." — Chaotic Eclipse/Nightmare Eclipse

From RCE to LPE: Forced Evolution

RoguePlanet did not originate as a local escalation. According to the researcher's statements reported by Help Net Security, the vulnerability was initially developed as a remote code execution via VHDX files hosted on SMB shares. The patch Microsoft shipped in May 2026 blocked remote paths, making network-based execution impractical.

The researcher then re-adapted the exploit for local use, preserving the ability to reach SYSTEM privileges. As reported by Help Net Security, the researcher stated: "In initial development, it was confirmed that this vulnerability was a remote code execution... a Windows Defender patch Microsoft pushed out in May might have made remote code execution impossible."

The researcher claims the vulnerability also exists on Windows Server, though the current PoC does not work there because standard users cannot mount ISO/VHD images. Sources do not independently verify that an adaptation is technically feasible.

Independent Validations and Limits

Will Dormann tested the exploit, reporting: "it's reportedly not 100% reliable, but it worked on the first attempt for me." The qualifier "reportedly" — indicating that variable reliability is second-hand information, not direct observation — is present in the original quote.

ThreatLocker independently reproduced the exploit on Windows 11 with KB5094126 applied, confirming functionality on a patched system. In ThreatLocker's tests, application allowlisting blocked execution. Picus Security confirmed mechanistic plausibility without fully reproducing the PoC.

Why a Defender Flaw Is Different

Microsoft Defender is not optional third-party software: it is preinstalled on every modern Windows system, non-removable for many enterprise configurations, and operates with maximum system privileges. A flaw in its protection engine propagates through the entire security supply chain: the antivirus itself becomes the compromise vector, not the barrier.

This structure makes mitigation by replacement impossible for most organizations. Where an alternative endpoint product can be removed or swapped, Defender remains present even when "disabled," with system components continuing to operate in the background.

What to Do Now

The following guidance derives from specific vendor analyses documented in the brief, not from general unverified operational recommendations:

Monitor for anomalies in the MsMpEng.exe → system-level process parent-child pattern, flagged by Picus Security as a behavioral indicator
Evaluate application allowlisting: ThreatLocker documented blocking the exploit in independent tests
Verify that KB5094126 — validated by ThreatLocker, not confirmed as a requirement by Microsoft — is applied as a June 2026 patch baseline
Recognize that Windows Server is not currently vulnerable to the published PoC, but monitor for adapted variants

Microsoft has not communicated timelines for a potential out-of-band patch nor confirmed inclusion in the July 2026 cycle.

Editorial Close

RoguePlanet exists in a space of calculated uncertainty: Microsoft investigates without a patch, the researcher threatens further disclosures, and the software involved is the one most organizations cannot remove. The Nightmare Eclipse campaign has already demonstrated real-world exploitation capability with prior exploits. For this specific zero-day, the line between proof-of-concept and weaponization has not yet been crossed — but the window remains open.

Information verified against cited sources and current as of publication.

Sources

Sources and references