Microsoft released a patch for the RoguePlanet (CVE-2026-50656) zero-day vulnerability in Microsoft Defender's Malware Protection Engine. This
Since April, researchers have陆续 disclosed multiple zero-day vulnerabilities targeting Microsoft Defender and Windows built-in features, releasing them publicly as proof-of-concept (PoC) code, shocking the cybersecurity community. Most of these vulnerabilities have been patched. The recently disclosed vulnerability exists in the Microsoft Defender malware protection engine, is an Elevation of Privilege (EoP) type, has a CVSS severity score of 7.8, and is classified as a high-risk vulnerability[1][2].
According to Microsoft's security update advisory, the vulnerability is categorized under CWE-59, which is the "improper link resolution before file access" (link following) issue. An attacker can gain SYSTEM-level access in a local environment with low privileges and without user interaction, thereby fully controlling the system[1][9]. Although Microsoft currently states no signs of actual exploitation have been found, it continues to warn that the likelihood of exploitation is high due to low attack complexity and extremely low privilege requirements[1].
The core of the vulnerability lies in the Microsoft Malware Protection Engine, the core component of Microsoft Defender for malware scanning and threat handling[1][3]. Technically, the vulnerability stems from a "race condition" flaw, causing incorrect resolution of symbolic links (symlinks) before file access, which allows attackers to obtain a shell with system privileges through specific timing operations[1][3][6].
Researchers note that this PoC can successfully execute regardless of whether Defender's Real-time Protection is enabled, indicating that even disabling Defender cannot defend against this attack[1][3]. The attack process requires only a local low-privilege account, without network interaction or user confirmation, meeting the definition of "zero-day"—meaning the vulnerability was publicly disclosed and exploitable before a patch existed[3]. The CVSSv3.1 score of 7.8 reflects its characteristics of local attack, low complexity, no user interaction, and high impact[2].
Affected versions are older versions of the Microsoft Malware Protection Engine; patched versions are the updated version or higher[1][2]. This vulnerability applies to Windows 10 and Windows 11 systems, and may affect systems regardless of whether Real-time Protection is enabled[1][3]. Since Microsoft Defender is the default antivirus solution for Windows, almost all Windows devices without third-party antivirus software are potentially exposed to this risk[1].
Malwarebytes emphasizes that even if Microsoft Defender is disabled, this vulnerability cannot be avoided because the attack targets the engine itself rather than protective behavior[1]. Additionally, such vulnerabilities carry repetitive and systemic risks and should be viewed as a persistent threat category rather than a single event[3].
The primary measure is to immediately perform Windows updates to ensure the Microsoft Malware Protection Engine version is upgraded to the patched version or higher[1][2]. Users can check the engine version via the PowerShell command Get-MpComputerStatus or confirm the update status in the Microsoft Defender interface[2]. If the version is outdated, update immediately to avoid exploitation[1].
Second, it is recommended to deploy additional protection layers, such as memory execution control mechanisms, to block malicious code execution independently of Defender, reducing the risk of the "detector becoming an attack surface"[3]. Local administrator privileges should also be restricted, and network segmentation implemented to narrow the impact scope after SYSTEM privileges are stolen[3]. Additionally, do not download and execute files from untrusted sources, avoid executing unrequested documents, and regularly back up important data to external locations[1].
Get-MpComputerStatus to check the current engine version and confirm whether it is an affected older version.