Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

Microsoft Defender bug CVE-2026-50656 allows admin takeover

Part of the CVE-2026-50656 story · since 17 Jun

Quiet for 7 weekslast report 10 Sep13 articles6 outlets
17 Jun · SecurityWeek first24 Aug16 Sep9 OctNowThis article1st of 13
  • Wed 17 Jun, 10:10 UTC. SecurityWeek, first report. Microsoft Defender bug CVE-2026-50656 allows admin takeover. This article, 1st of 13.
  • Thu 18 Jun, 10:30 UTC. Security Affairs, its first report on the story. Microsoft Defender Zero Day Lets Attackers Run SYSTEM Code.
  • Thu 18 Jun, 13:30 UTC. Malwarebytes, its first report on the story. Microsoft Defender Bug CVE-2026-50656 Allows Full Windows Control.
  • Thu 9 Jul, 11:09 UTC. SecurityWeek. Microsoft patches privilege escalation flaw CVE-2026-50.
  • Thu 9 Jul, 11:09 UTC. SecurityOnline, its first report on the story. Microsoft Patches RoguePlanet Defender Zero-Day That Grants SYSTEM Access.
  • Thu 9 Jul, 11:46 UTC. Security Affairs. Microsoft patches Defender bug CVE-2026-50656 after local exploit.
  • Thu 9 Jul, 11:47 UTC. Malwarebytes. Microsoft patches zero day EoP flaw in Defender, CVE-2026-50656.
  • Thu 9 Jul, 21:01 UTC. Ars Technica, its first report on the story. Patch for Windows Defender 0-day could allow attackers to fill hard disk.
  • Thu 9 Jul, 21:01 UTC. Dark Reading, its first report on the story. Microsoft patches Windows Defender zero day CVE-2026-50656.
  • Wed 12 Aug, 06:26 UTC. SecurityOnline. ShieldBreak Exploit Exposes Defender Patch Flaw CVE-2026-50656.
  • Wed 12 Aug, 08:32 UTC. Security Affairs. Proof of concept bypasses Defender patch for CVE-2026-50656.
  • Thu 13 Aug, 08:51 UTC. SecurityWeek. ShieldBreak exploit hits Microsoft Defender via CVE-2026-50656.
  • Thu 10 Sep, 07:30 UTC. SecurityWeek. Microsoft Defender Zero Day Bypasses Patches to Expose Windows Systems.

Microsoft recently acknowledged a vulnerability in its Defender software, tracked as CVE-2026-50656, which could allow for privilege escalation, with a CVSS score of 7.8. This vulnerability, called 'RoguePlanet', was disclosed by researcher Nightmare Eclipse, who also provided a proof-of-concept exploit demonstrating local privilege escalation on Windows systems. Microsoft is working on a security update and has already patched earlier exploits from the same researcher.

The advisory highlights ongoing tensions regarding Microsoft's vulnerability disclosure practices, with previous exploits like BlueHammer and RedSun also being discussed.

How the story developed

All 13 articles
Quiet for 7 weekslast report 10 Sep13 articles6 outlets

13 articles from 6 outlets since 17 Jun. Quiet since 10 Sep. This was the first report.

Now17 Jun2625811 Aug9 SepFirst reportSecurityWeek · 17 Jun, 10:10Picked up againafter 3 weeks quiet
  • Wed 17 Jun, 10:10 UTC. SecurityWeek, first report. Microsoft Defender bug CVE-2026-50656 allows admin takeover. This article, 1st of 13.
  • Thu 18 Jun, 10:30 UTC. Security Affairs, its first report on the story. Microsoft Defender Zero Day Lets Attackers Run SYSTEM Code.
  • Thu 18 Jun, 13:30 UTC. Malwarebytes, its first report on the story. Microsoft Defender Bug CVE-2026-50656 Allows Full Windows Control.
  • Thu 9 Jul, 11:09 UTC. SecurityWeek. Microsoft patches privilege escalation flaw CVE-2026-50.
  • Thu 9 Jul, 11:09 UTC. SecurityOnline, its first report on the story. Microsoft Patches RoguePlanet Defender Zero-Day That Grants SYSTEM Access.
  • Thu 9 Jul, 11:46 UTC. Security Affairs. Microsoft patches Defender bug CVE-2026-50656 after local exploit.
  • Thu 9 Jul, 11:47 UTC. Malwarebytes. Microsoft patches zero day EoP flaw in Defender, CVE-2026-50656.
  • Thu 9 Jul, 21:01 UTC. Ars Technica, its first report on the story. Patch for Windows Defender 0-day could allow attackers to fill hard disk.
  • Thu 9 Jul, 21:01 UTC. Dark Reading, its first report on the story. Microsoft patches Windows Defender zero day CVE-2026-50656.
  • Wed 12 Aug, 06:26 UTC. SecurityOnline. ShieldBreak Exploit Exposes Defender Patch Flaw CVE-2026-50656.
  • Wed 12 Aug, 08:32 UTC. Security Affairs. Proof of concept bypasses Defender patch for CVE-2026-50656.
  • Thu 13 Aug, 08:51 UTC. SecurityWeek. ShieldBreak exploit hits Microsoft Defender via CVE-2026-50656.
  • Thu 10 Sep, 07:30 UTC. SecurityWeek. Microsoft Defender Zero Day Bypasses Patches to Expose Windows Systems.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 13 articles as a list
  1. Wed 17 JunDay 01
    1. Microsoft Defender bug CVE-2026-50656 allows admin takeover10:10 · SecurityWeek · First report · This article, 1st of 13
  2. Thu 18 JunDay 12
    1. Microsoft Defender Zero Day Lets Attackers Run SYSTEM Code10:30 · Security Affairs
    2. Microsoft Defender Bug CVE-2026-50656 Allows Full Windows Control13:30 · Malwarebytes

  3. Quiet for 3 weeks

    Thu 9 JulDay 226
    1. Microsoft patches privilege escalation flaw CVE-2026-5011:09 · SecurityWeek · Picked up again
    2. Microsoft Patches RoguePlanet Defender Zero-Day That Grants SYSTEM Access11:09 · SecurityOnline
    3. Microsoft patches Defender bug CVE-2026-50656 after local exploit11:46 · Security Affairs
    Show 3 more from 9 Jul
    1. Microsoft patches zero day EoP flaw in Defender, CVE-2026-5065611:47 · Malwarebytes
    2. Patch for Windows Defender 0-day could allow attackers to fill hard disk21:01 · Ars Technica
    3. Microsoft patches Windows Defender zero day CVE-2026-5065621:01 · Dark Reading

  4. Quiet for 5 weeks

    Wed 12 AugDay 562
    1. ShieldBreak Exploit Exposes Defender Patch Flaw CVE-2026-5065606:26 · SecurityOnline · Picked up again
    2. Proof of concept bypasses Defender patch for CVE-2026-5065608:32 · Security Affairs
  5. Thu 13 AugDay 571
    1. ShieldBreak exploit hits Microsoft Defender via CVE-2026-5065608:51 · SecurityWeek

  6. Quiet for 4 weeks

    Thu 10 SepDay 851
    1. Microsoft Defender Zero Day Bypasses Patches to Expose Windows Systems07:30 · SecurityWeek · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in