CVE-2026-50656 "RoguePlanet" Flaw Lets Attackers Escalate Privileges via Defender

A newly disclosed elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine, the core scanning component behind Windows Defender, has security teams paying close attention this week.

Tracked as CVE-2026-50656 and nicknamed “RoguePlanet,” the flaw exploits how Defender resolves file links before accessing them, potentially allowing a local attacker to gain higher-level privileges on affected systems.

Microsoft assigned the bug an “Important” severity rating with a CVSS score of 7.8. While the company hasn’t observed active exploitation in the wild, it has flagged the exploitability assessment as “Exploitation More Likely.”

RoguePlane Flaw

That combination, a publicly disclosed flaw in software running on virtually every Windows machine, paired with a realistic path to exploitation, makes RoguePlanet worth understanding even if you never touch the patch yourself.

RoguePlanet stems from CWE-59, Improper Link Resolution Before File Access, more commonly known as a “link following” vulnerability.

In plain terms, mpengine.dll, the DLL that powers Defender’s scanning and cleaning capabilities, doesn’t properly verify a file’s identity before acting on it when the file is referenced via a symbolic link or junction point.

An attacker with existing low-privilege access to a device could exploit this by planting a malicious link that Defender’s engine follows during a routine scan.

Because Defender operates with elevated privileges to do its job, tricking it into interacting with the wrong file can hand the attacker a path to SYSTEM-level access.

The attack vector is local (AV:L), requiring some prior access but no user interaction, which lowers the bar for exploitation once an attacker has a foothold.

Every supported version of Windows ships with Defender enabled by default, so the exposure footprint is enormous. The vulnerability also extends to legacy products sharing the same engine, including System Center Endpoint Protection and Microsoft Security Essentials.

Microsoft’s fix timeline:

Last vulnerable engine version: 1.1.26050.11
First patched version: 1.1.26060.3008

Because Defender updates its engine and definitions automatically, most organizations with standard configurations were likely protected within hours of release; no manual patch deployment required.

Microsoft’s own FAQ tackles a recurring point of confusion: vulnerability scanners often flag systems as exposed even when administrators believe Defender is disabled. The explanation is straightforward: Defender’s binaries remain on disk regardless of whether the service is active, so scanners detect the vulnerable file version without confirming exploitability.

If Defender is genuinely disabled, the system isn’t in an exploitable state for this specific CVE, though that’s arguably cold comfort given how few environments run without any Defender component at all.

RoguePlanet is a useful reminder that security software itself is not immune to the same classes of vulnerabilities it’s designed to detect.

Link-following bugs have a long history in privilege escalation research precisely because they exploit the trust gap between a process’s permissions and its ability to verify what it’s actually touching.

For defenders, the practical takeaway isn’t urgent manual patching; automatic updates handle that, but rather verifying that automatic update pipelines are functioning as expected.

Microsoft explicitly recommends this as a best practice, and RoguePlanet is a good occasion to confirm it’s actually happening in your environment rather than assuming it is.