## What happened
A researcher using the alias Nightmare Eclipse (also Chaotic Eclipse) publicly released an exploit for a Windows Defender vulnerability now tracked as CVE-2026-50656, rated CVSS 7.8. Microsoft has confirmed the flaw is real and says a fix is still in development, without committing to a release date. The researcher has been publishing zero-day exploits for Microsoft software since around March 2026, reportedly following a dispute with the company.
## How it works
The vulnerability sits in the Microsoft Defender malware protection engine, the component meant to watch for threats. RoguePlanet abuses a race condition in Defender to spawn a command shell running as SYSTEM, the highest privilege level on a Windows machine. This is local privilege escalation: a way to climb from limited access to full control of the host.
Notably, it works on fully patched Windows 10 and 11. Because exploitation depends on winning a race condition, it does not succeed every time, but an attacker who already has a foothold can simply retry until it works.
## Why it matters
This is not a remote attack. An attacker first needs to be running code on the machine as a normal user, typically obtained through phishing or a malicious download. RoguePlanet then upgrades that limited foothold to complete control of the host. Initial access combined with a reliable local privilege escalation is the standard pattern behind ransomware deployments and deeper intrusions, which is what makes this kind of flaw valuable to attackers.
The complicating factor is that there is no patch yet, so defense currently rests on the surrounding controls rather than a fix.
## What to do
- Tighten how code is allowed to execute on endpoints, since the exploit is useless to an attacker who cannot first gain that initial foothold.- Watch endpoint telemetry for Defender processes spawning command shells, which is anomalous and worth alerting on.- Apply Microsoft's patch as soon as it ships.
Sources: SecurityWeek, Help Net Security, BleepingComputer, The Hacker News.