CVE-2026-50656 (RoguePlanet) is a local privilege escalation vulnerability in Microsoft Defender's Malware Protection Engine that allows authenticated users to gain SYSTEM-level access via a race condition and improper link resolution. Microsoft patched the original issue in July 2026 with Engine v1.1.26060.3008, but a bypass named ShieldBreak was publicly released on August 12, 2026, demonstrating that patched environments remain exploitable. The attack is entirely local with no network indicators, requiring host-based behavioral detection focused on anomalous MsMPEng.exe activity.
CVE-2026-50656
1 post
Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak) - Arctic Wolf