Skip to content
OriginalSign in
Image: Malwarebytes

Malwarebytes

Microsoft Defender Bug CVE-2026-50656 Allows Full Windows Control

Part of the CVE-2026-50656 story · since 17 Jun

Quiet for 8 weekslast report 10 Sep13 articles6 outlets
17 Jun · SecurityWeek first27 Aug20 SepNowThis article3rd of 13
  • Wed 17 Jun, 10:10 UTC. SecurityWeek, first report. Microsoft Defender bug CVE-2026-50656 allows admin takeover.
  • Thu 18 Jun, 10:30 UTC. Security Affairs, its first report on the story. Microsoft Defender Zero Day Lets Attackers Run SYSTEM Code.
  • Thu 18 Jun, 13:30 UTC. Malwarebytes, its first report on the story. Microsoft Defender Bug CVE-2026-50656 Allows Full Windows Control. This article, 3rd of 13.
  • Thu 9 Jul, 11:09 UTC. SecurityWeek. Microsoft patches privilege escalation flaw CVE-2026-50.
  • Thu 9 Jul, 11:09 UTC. SecurityOnline, its first report on the story. Microsoft Patches RoguePlanet Defender Zero-Day That Grants SYSTEM Access.
  • Thu 9 Jul, 11:46 UTC. Security Affairs. Microsoft patches Defender bug CVE-2026-50656 after local exploit.
  • Thu 9 Jul, 11:47 UTC. Malwarebytes. Microsoft patches zero day EoP flaw in Defender, CVE-2026-50656.
  • Thu 9 Jul, 21:01 UTC. Ars Technica, its first report on the story. Patch for Windows Defender 0-day could allow attackers to fill hard disk.
  • Thu 9 Jul, 21:01 UTC. Dark Reading, its first report on the story. Microsoft patches Windows Defender zero day CVE-2026-50656.
  • Wed 12 Aug, 06:26 UTC. SecurityOnline. ShieldBreak Exploit Exposes Defender Patch Flaw CVE-2026-50656.
  • Wed 12 Aug, 08:32 UTC. Security Affairs. Proof of concept bypasses Defender patch for CVE-2026-50656.
  • Thu 13 Aug, 08:51 UTC. SecurityWeek. ShieldBreak exploit hits Microsoft Defender via CVE-2026-50656.
  • Thu 10 Sep, 07:30 UTC. SecurityWeek. Microsoft Defender Zero Day Bypasses Patches to Expose Windows Systems.

Microsoft confirmed a critical vulnerability named RoguePlanet (CVE-2026-50656) that allows attackers to gain complete control over Windows systems by exploiting weaknesses in Microsoft Defender's Malware Protection Engine. The flaw enables privilege escalation from a standard user to NT AUTHORITY\SYSTEM without requiring advanced hacking skills. Microsoft is currently developing a security update to address this issue.

Users are advised to monitor for updates, back up important data, and consider additional anti-malware solutions like Malwarebytes, which can detect the exploit based on its behavior.

How the story developed

All 13 articles
Quiet for 8 weekslast report 10 Sep13 articles6 outlets

13 articles from 6 outlets since 17 Jun. Quiet since 10 Sep. This was the 3rd report, 1 day after the first.

Now17 Jun2625811 Aug9 SepFirst reportSecurityWeek · 17 Jun, 10:10Picked up againafter 3 weeks quiet
  • Wed 17 Jun, 10:10 UTC. SecurityWeek, first report. Microsoft Defender bug CVE-2026-50656 allows admin takeover.
  • Thu 18 Jun, 10:30 UTC. Security Affairs, its first report on the story. Microsoft Defender Zero Day Lets Attackers Run SYSTEM Code.
  • Thu 18 Jun, 13:30 UTC. Malwarebytes, its first report on the story. Microsoft Defender Bug CVE-2026-50656 Allows Full Windows Control. This article, 3rd of 13.
  • Thu 9 Jul, 11:09 UTC. SecurityWeek. Microsoft patches privilege escalation flaw CVE-2026-50.
  • Thu 9 Jul, 11:09 UTC. SecurityOnline, its first report on the story. Microsoft Patches RoguePlanet Defender Zero-Day That Grants SYSTEM Access.
  • Thu 9 Jul, 11:46 UTC. Security Affairs. Microsoft patches Defender bug CVE-2026-50656 after local exploit.
  • Thu 9 Jul, 11:47 UTC. Malwarebytes. Microsoft patches zero day EoP flaw in Defender, CVE-2026-50656.
  • Thu 9 Jul, 21:01 UTC. Ars Technica, its first report on the story. Patch for Windows Defender 0-day could allow attackers to fill hard disk.
  • Thu 9 Jul, 21:01 UTC. Dark Reading, its first report on the story. Microsoft patches Windows Defender zero day CVE-2026-50656.
  • Wed 12 Aug, 06:26 UTC. SecurityOnline. ShieldBreak Exploit Exposes Defender Patch Flaw CVE-2026-50656.
  • Wed 12 Aug, 08:32 UTC. Security Affairs. Proof of concept bypasses Defender patch for CVE-2026-50656.
  • Thu 13 Aug, 08:51 UTC. SecurityWeek. ShieldBreak exploit hits Microsoft Defender via CVE-2026-50656.
  • Thu 10 Sep, 07:30 UTC. SecurityWeek. Microsoft Defender Zero Day Bypasses Patches to Expose Windows Systems.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 13 articles as a list
  1. Wed 17 JunDay 01
    1. Microsoft Defender bug CVE-2026-50656 allows admin takeover10:10 · SecurityWeek · First report
  2. Thu 18 JunDay 12
    1. Microsoft Defender Zero Day Lets Attackers Run SYSTEM Code10:30 · Security Affairs
    2. Microsoft Defender Bug CVE-2026-50656 Allows Full Windows Control13:30 · Malwarebytes · This article, 3rd of 13

  3. Quiet for 3 weeks

    Thu 9 JulDay 226
    1. Microsoft patches privilege escalation flaw CVE-2026-5011:09 · SecurityWeek · Picked up again
    2. Microsoft Patches RoguePlanet Defender Zero-Day That Grants SYSTEM Access11:09 · SecurityOnline
    3. Microsoft patches Defender bug CVE-2026-50656 after local exploit11:46 · Security Affairs
    Show 3 more from 9 Jul
    1. Microsoft patches zero day EoP flaw in Defender, CVE-2026-5065611:47 · Malwarebytes
    2. Patch for Windows Defender 0-day could allow attackers to fill hard disk21:01 · Ars Technica
    3. Microsoft patches Windows Defender zero day CVE-2026-5065621:01 · Dark Reading

  4. Quiet for 5 weeks

    Wed 12 AugDay 562
    1. ShieldBreak Exploit Exposes Defender Patch Flaw CVE-2026-5065606:26 · SecurityOnline · Picked up again
    2. Proof of concept bypasses Defender patch for CVE-2026-5065608:32 · Security Affairs
  5. Thu 13 AugDay 571
    1. ShieldBreak exploit hits Microsoft Defender via CVE-2026-5065608:51 · SecurityWeek

  6. Quiet for 4 weeks

    Thu 10 SepDay 851
    1. Microsoft Defender Zero Day Bypasses Patches to Expose Windows Systems07:30 · SecurityWeek · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in