Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

Microsoft Defender Zero Day Lets Attackers Run SYSTEM Code

Part of the CVE-2026-50656 story · since 17 Jun

Quiet for 8 weekslast report 10 Sep13 articles6 outlets
17 Jun · SecurityWeek first27 Aug20 SepNowThis article2nd of 13
  • Wed 17 Jun, 10:10 UTC. SecurityWeek, first report. Microsoft Defender bug CVE-2026-50656 allows admin takeover.
  • Thu 18 Jun, 10:30 UTC. Security Affairs, its first report on the story. Microsoft Defender Zero Day Lets Attackers Run SYSTEM Code. This article, 2nd of 13.
  • Thu 18 Jun, 13:30 UTC. Malwarebytes, its first report on the story. Microsoft Defender Bug CVE-2026-50656 Allows Full Windows Control.
  • Thu 9 Jul, 11:09 UTC. SecurityWeek. Microsoft patches privilege escalation flaw CVE-2026-50.
  • Thu 9 Jul, 11:09 UTC. SecurityOnline, its first report on the story. Microsoft Patches RoguePlanet Defender Zero-Day That Grants SYSTEM Access.
  • Thu 9 Jul, 11:46 UTC. Security Affairs. Microsoft patches Defender bug CVE-2026-50656 after local exploit.
  • Thu 9 Jul, 11:47 UTC. Malwarebytes. Microsoft patches zero day EoP flaw in Defender, CVE-2026-50656.
  • Thu 9 Jul, 21:01 UTC. Ars Technica, its first report on the story. Patch for Windows Defender 0-day could allow attackers to fill hard disk.
  • Thu 9 Jul, 21:01 UTC. Dark Reading, its first report on the story. Microsoft patches Windows Defender zero day CVE-2026-50656.
  • Wed 12 Aug, 06:26 UTC. SecurityOnline. ShieldBreak Exploit Exposes Defender Patch Flaw CVE-2026-50656.
  • Wed 12 Aug, 08:32 UTC. Security Affairs. Proof of concept bypasses Defender patch for CVE-2026-50656.
  • Thu 13 Aug, 08:51 UTC. SecurityWeek. ShieldBreak exploit hits Microsoft Defender via CVE-2026-50656.
  • Thu 10 Sep, 07:30 UTC. SecurityWeek. Microsoft Defender Zero Day Bypasses Patches to Expose Windows Systems.

Microsoft has confirmed a zero-day vulnerability in its Defender software, tracked as CVE-2026-50656, which enables privilege escalation due to a flaw in the Malware Protection Engine. While a security patch is under development, the issue was brought to light by researcher Chaotic Eclipse, who developed a proof-of-concept exploit. The vulnerability is a race condition that allows attackers to run code with SYSTEM-level privileges.

Despite Microsoft’s efforts to enhance defenses, the exploit was tested successfully on updated Windows 10 and 11 systems, raising concerns about continued vulnerability even with real-time protection enabled. The researcher has hinted at additional memory corruption issues within Defender and has expressed frustration over Microsoft's handling of vulnerability reports. Microsoft asserts it is actively investigating the claims regarding RoguePlanet and stresses the importance of coordinated vulnerability disclosure.

How the story developed

All 13 articles
Quiet for 8 weekslast report 10 Sep13 articles6 outlets

13 articles from 6 outlets since 17 Jun. Quiet since 10 Sep. This was the 2nd report, 1 day after the first.

Now17 Jun2625811 Aug9 SepFirst reportSecurityWeek · 17 Jun, 10:10This article2nd of 13 · day 1Picked up againafter 3 weeks quiet
  • Wed 17 Jun, 10:10 UTC. SecurityWeek, first report. Microsoft Defender bug CVE-2026-50656 allows admin takeover.
  • Thu 18 Jun, 10:30 UTC. Security Affairs, its first report on the story. Microsoft Defender Zero Day Lets Attackers Run SYSTEM Code. This article, 2nd of 13.
  • Thu 18 Jun, 13:30 UTC. Malwarebytes, its first report on the story. Microsoft Defender Bug CVE-2026-50656 Allows Full Windows Control.
  • Thu 9 Jul, 11:09 UTC. SecurityWeek. Microsoft patches privilege escalation flaw CVE-2026-50.
  • Thu 9 Jul, 11:09 UTC. SecurityOnline, its first report on the story. Microsoft Patches RoguePlanet Defender Zero-Day That Grants SYSTEM Access.
  • Thu 9 Jul, 11:46 UTC. Security Affairs. Microsoft patches Defender bug CVE-2026-50656 after local exploit.
  • Thu 9 Jul, 11:47 UTC. Malwarebytes. Microsoft patches zero day EoP flaw in Defender, CVE-2026-50656.
  • Thu 9 Jul, 21:01 UTC. Ars Technica, its first report on the story. Patch for Windows Defender 0-day could allow attackers to fill hard disk.
  • Thu 9 Jul, 21:01 UTC. Dark Reading, its first report on the story. Microsoft patches Windows Defender zero day CVE-2026-50656.
  • Wed 12 Aug, 06:26 UTC. SecurityOnline. ShieldBreak Exploit Exposes Defender Patch Flaw CVE-2026-50656.
  • Wed 12 Aug, 08:32 UTC. Security Affairs. Proof of concept bypasses Defender patch for CVE-2026-50656.
  • Thu 13 Aug, 08:51 UTC. SecurityWeek. ShieldBreak exploit hits Microsoft Defender via CVE-2026-50656.
  • Thu 10 Sep, 07:30 UTC. SecurityWeek. Microsoft Defender Zero Day Bypasses Patches to Expose Windows Systems.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 13 articles as a list
  1. Wed 17 JunDay 01
    1. Microsoft Defender bug CVE-2026-50656 allows admin takeover10:10 · SecurityWeek · First report
  2. Thu 18 JunDay 12
    1. Microsoft Defender Zero Day Lets Attackers Run SYSTEM Code10:30 · Security Affairs · This article, 2nd of 13
    2. Microsoft Defender Bug CVE-2026-50656 Allows Full Windows Control13:30 · Malwarebytes

  3. Quiet for 3 weeks

    Thu 9 JulDay 226
    1. Microsoft patches privilege escalation flaw CVE-2026-5011:09 · SecurityWeek · Picked up again
    2. Microsoft Patches RoguePlanet Defender Zero-Day That Grants SYSTEM Access11:09 · SecurityOnline
    3. Microsoft patches Defender bug CVE-2026-50656 after local exploit11:46 · Security Affairs
    Show 3 more from 9 Jul
    1. Microsoft patches zero day EoP flaw in Defender, CVE-2026-5065611:47 · Malwarebytes
    2. Patch for Windows Defender 0-day could allow attackers to fill hard disk21:01 · Ars Technica
    3. Microsoft patches Windows Defender zero day CVE-2026-5065621:01 · Dark Reading

  4. Quiet for 5 weeks

    Wed 12 AugDay 562
    1. ShieldBreak Exploit Exposes Defender Patch Flaw CVE-2026-5065606:26 · SecurityOnline · Picked up again
    2. Proof of concept bypasses Defender patch for CVE-2026-5065608:32 · Security Affairs
  5. Thu 13 AugDay 571
    1. ShieldBreak exploit hits Microsoft Defender via CVE-2026-5065608:51 · SecurityWeek

  6. Quiet for 4 weeks

    Thu 10 SepDay 851
    1. Microsoft Defender Zero Day Bypasses Patches to Expose Windows Systems07:30 · SecurityWeek · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in