Microsoft acknowledges RoguePlanet zero-day exploit targeting Defender privilege escalation (CVE-2026-50656)

Summary

Microsoft has acknowledged a local elevation of privilege vulnerability (CVE-2026-50656) in Microsoft Defender, triggered via the "RoguePlanet" exploit released by the threat group Nightmare Eclipse. The vulnerability stems from improper link resolution before file access, allowing low-complexity attacks by authenticated attackers with no user interaction required. Microsoft states it is working on a high-quality security update to address the issue.