Microsoft patches Nightmare Eclipse's RoguePlanet Defender zero-day

Microsoft has fixed the RoguePlanet zero-day vulnerability in Microsoft Defender, weeks after security researcher Nightmare Eclipse published exploit code for the flaw.

Microsoft addressed the bug outside its regular Patch Tuesday cycle. The company updated the Microsoft Malware Protection Engine to resolve CVE-2026-50656. Customers must run the latest engine version to receive the protection.

The vulnerability first appeared in June when Nightmare Eclipse released technical details and a proof-of-concept exploit. The researcher claimed RoguePlanet could spawn a command prompt with SYSTEM privileges on fully patched Windows 10 and Windows 11 systems by exploiting a race condition in Defender.

The exploit's success depended on precise timing. Nightmare Eclipse described it as a race condition that delivered a 100 percent success rate on some machines but struggled on others. The bug reportedly worked whether or not Defender's real-time protection was enabled.

When The Register first reported on RoguePlanet in June, Microsoft said only that it was investigating the claims. The company has now completed that probe and issued the fix but has not explained the technical changes or confirmed any real-world exploitation beyond the published proof-of-concept.

RoguePlanet marks the seventh zero-day publicly disclosed by Nightmare Eclipse since April. The researcher, who claims to be a former Microsoft employee, has conducted an increasingly acrimonious campaign against the company's vulnerability disclosure and bug bounty programs. Nightmare Eclipse has accused Microsoft of ignoring reports, deleting submission accounts, and treating independent researchers with contempt.

Microsoft initially warned that publishing exploit code could carry legal consequences. Security researchers pushed back, prompting the company to clarify it had no intention of pursuing action against legitimate security research. The researcher also alleged that Microsoft removed RoguePlanet proof-of-concept repositories from GitHub and GitLab before the code moved to a self-hosted location.

With the patch for CVE-2026-50656 now live, Microsoft has closed every public zero-day disclosed by Nightmare Eclipse earlier this year.