CVE-2026-50656
HIGH · 7.8 EPSS 11.4%Real vuln, vendor patching, but PoC claim unverified; no KEV listing or in-the-wild confirmation.
What: Local privilege escalation in Microsoft Defender's Malware Protection Engine via race condition, affecting Windows 10/11. CVSS 7.8 (HIGH), EPSS 0.30%.
Why it matters: Microsoft acknowledged the zero-day on 2026-06-16 and stated a patch is in development. Posts 7–8 claim public PoC exists, but NVD and official channels show no KEV listing, no patch released, and vendor still developing the fix. The "public PoC" claim lacks corroboration in authoritative sources.
Where it's seen: Multilingual social chatter (Japanese, English) across Bluesky citing news aggregators (HackerNews, HelpNetSecurity, EbisudaTech). Rhetoric emphasizes zero-day + race condition + SYSTEM escalation. Post 7 asserts PoC availability without evidence.
RISK: HIGH — Unpatched elevation-of-privilege in widely-deployed Defender; no KEV yet, patch pending.
Description
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ". We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the update is available.
CVSS 3.1 breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Local
- Complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High