Vulnerability in Microsoft Malware Protection Engine
CVE-2026-50656
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS 0.112, 96.0th percentile (scored ); up from 0.004 30 days earlier. About EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.112 · change: +0.108
Affected products
- Microsoft Malware Protection Engine
- Microsoft Malware Protection Engine — versions 1.1.0.0
Weakness classification (CWE)
Public exploits and proof-of-concept code
6 public repositories with exploit or proof-of-concept code for this CVE:
- 0xBlackash/CVE-2026-50656 (10 stars, last pushed 2026-06-18): CVE-2026-50656
- 0xredash/CVE-2026-50656 (10 stars, last pushed 2026-06-18): CVE-2026-50656
- ashrafzaryouh/CVE-2026-50656 (10 stars, last pushed 2026-06-18): CVE-2026-50656
- g0thamRabb1t/CVE-2026-50656-rogueplanet-validation (2 stars, last pushed 2026-06-10): Validation report for the RoguePlanet Microsoft Defender PoC in a controlled Windows 11 lab environment, including build notes, Defender detection results, risk assessment, and mitigation recommendat…
- eh-amish/Windows-Defender-Security-Auditor-CVE-2026-50656- (1 star, last pushed 2026-08-16)
- HORKimhab/CVE-2026-50656 (last pushed 2026-09-09): CVE-2026-50656, CVE-2026-69414
References
- Microsoft Defender Elevation of Privilege Vulnerability (vendor-advisory, patch, Vendor Advisory)
- github.com/MSNightmare/RoguePlanet (Product)
- github.com/MSNightmare/ShieldBreak
This CVE has public exploit evidence. See the latest CVEs with public exploits.