Microsoft has released security updates to address CVE-2026-50656, a newly disclosed zero-day vulnerability publicly referred to as RoguePlanet, affecting the Microsoft Malware Protection Engine. The flaw is an elevation-of-privilege (EoP) vulnerability with a CVSS v3.1 score of (High) and is caused by improper link resolution before file access (CWE-59). An attacker with low-privileged local access can exploit the weakness to gain elevated system privileges, potentially compromising the confidentiality, integrity, and availability of affected systems. Although Microsoft confirmed the vulnerability was publicly disclosed, it stated there is no evidence of active exploitation at the time of disclosure, while assessing future exploitation as more likely.

The vulnerability affects Microsoft Malware Protection Engine versions prior to 1.1.26060.3008, with systems running version 1.1.26050.11 or earlier considered vulnerable. Microsoft has remediated the issue in version 1.1.26060.3008, which is being distributed through its regular security update process. Because the Malware Protection Engine is a core component of several Microsoft security products including Microsoft Defender Antivirus, Microsoft Security Essentials, and System Center Endpoint Protection the vulnerability presents a broad attack surface across both enterprise and consumer environments. The attack requires local access, involves low attack complexity, and does not require user interaction, making it particularly valuable for attackers who have already established an initial foothold on a target system.

Microsoft noted that most users do not need to take manual action, as Microsoft Defender automatically receives engine and signature updates multiple times per day. Organizations should, however, verify that automatic updates are functioning correctly and confirm that all endpoints have upgraded to Malware Protection Engine version 1.1.26060.3008 or later. Microsoft also clarified that some vulnerability scanners may continue to flag systems where Microsoft Defender is disabled because the vulnerable binaries remain on disk. In practice, these systems are not exploitable unless the Defender engine is actively running, reducing the actual exposure in such scenarios despite scanner findings.

Beyond addressing CVE-2026-50656, Microsoft included additional defense-in-depth security improvements to strengthen the resilience of the Malware Protection Engine against future threats. The disclosure of the RoguePlanet vulnerability highlights the growing trend of attackers targeting endpoint security solutions themselves to bypass defensive controls and escalate privileges. Given Microsoft's assessment that exploitation is more likely, security teams should prioritize validating engine versions, ensuring successful deployment of the latest updates, and continuously monitoring endpoint protection infrastructure. Prompt patching remains the most effective mitigation to prevent privilege-escalation attacks and reduce the risk posed by vulnerabilities in critical security software.