Microsoft issued an update to fix a zero-day issue in its Defender software, referred to as RoguePlanet, which came to light after the June 2026 Patch Tuesday cycle.

The vulnerability, identified as CVE-2026-50656, was brought forward by a researcher known as Nightmare Eclipse amid ongoing disagreements with Microsoft concerning bug bounty programs and how vulnerabilities are disclosed.

The researcher also provided a proof-of-concept exploit through a personal repository, stating that Microsoft had previously taken down their exploit-hosting repositories on GitHub and GitLab.

Nightmare Eclipse indicated that RoguePlanet impacts fully updated Windows 10 and Windows 11 systems, enabling attackers to launch a command prompt with SYSTEM-level access by exploiting a race condition in Microsoft Defender.

"The exploit relies on a race condition, making it unpredictable. I achieved a 100 percent success rate on certain devices, though it performed inconsistently on others," the researcher noted. "The proof-of-concept for RoguePlanet functions whether real-time protection is enabled or disabled," they clarified later.

Microsoft acknowledged working on a fix for CVE-2026-50656 on June 16, yet has not credited Nightmare Eclipse for finding the issue.

Addressed Through Malware Protection Engine Update

On Wednesday, Microsoft resolved the RoguePlanet issue by deploying Microsoft Malware Protection Engine version 1.1.26060.3008, which updates the primary scanning engine used in its security products.

"Microsoft has issued an update to the Microsoft Malware Protection Engine to resolve the vulnerability listed as CVE-2026-50656. Refer to the FAQ for details on verifying the installation of the new version," Microsoft stated.

In recent months, Nightmare Eclipse has revealed several additional Windows zero-day exploits targeting issues like BlueHammer, RedSun, GreenPlasma, MiniPlasma, YellowKey, and UnDefend.

Some of these affect Microsoft Defender, while others impact BitLocker and other Windows elements. Microsoft addressed the GreenPlasma, MiniPlasma, and YellowKey problems last month during the June 2026 Patch Tuesday.

Microsoft responded to Nightmare Eclipse's revelations by threatening legal measures against individuals involved in activities it called "malicious activity causing real harm to our customers," prompting cybersecurity specialists to interpret this as a direct warning to the researcher.