A security researcher known as Nightmare Eclipse has released a fully working Microsoft Defender zero-day, nicknamed RoguePlanet, that grants attackers SYSTEM-level privileges on Windows 10 and Windows 11 machines that already have the just-released June 2026 Patch Tuesday updates installed. The proof-of-concept appeared hours after Microsoft shipped its largest-ever Patch Tuesday drop, immediately exposing the world's most widely deployed desktop EDR.
What RoguePlanet does
The exploit abuses a race condition in Microsoft Defender's MpEngine that lets a low-privileged process spawn a command prompt running as SYSTEM. Nightmare Eclipse published the code in a self-hosted Git repository at projectnightcrawler.dev after, the researcher says, GitHub and GitLab repeatedly removed earlier proofs. ThreatLocker told BleepingComputer it had reproduced the flaw on fully patched Windows 11 systems running KB5094126 and shared a video demo. "Our initial analysis confirms that the RoguePlanet exploit is viable and performs as described," said ThreatLocker chief executive Danny Jenkins, adding that application allowlisting can block the chain. The researcher concedes the race is "hit or miss" but says a 100% success rate is possible on some hardware.
Originally a remote code execution bug
According to Nightmare Eclipse, RoguePlanet was first developed as a remote code execution vulnerability that abused Microsoft Defender's handling of files hosted on remote SMB shares. "It required an attacker to coerce a victim to open a .vhd(x) in a remote SMB server, successful exploitation resulted in Defender overwriting its own files and obviously the end outcome was an RCE," the researcher wrote. Microsoft, the researcher claims, silently hardened the mpengine!SysIO* API in mid-May to kill junction attacks, downgrading the impact to local privilege escalation - though they did not rule out a future RCE rewrite.
The fifth public zero-day in a series
RoguePlanet is the fifth public zero-day Nightmare Eclipse has released in a long-running dispute with Microsoft over coordinated disclosure and bug-bounty payouts, after BlueHammer, RedSun, GreenPlasma and YellowKey. GreenPlasma and YellowKey were both patched in the same June 2026 Patch Tuesday batch that RoguePlanet now overshadows. Microsoft warned in May that it would work with law enforcement to pursue researchers engaged in "malicious activity causing real harm to our customers," a stance many in the security community read as a thinly veiled threat.
Why it matters
Defender ships as the default endpoint protection on most Windows estates, so a working SYSTEM-level race condition has immediate ransomware and post-compromise utility. RoguePlanet lands the same day the 200-CVE June Patch Tuesday dropped and a week after CISA added the BerriAI LiteLLM flaw to the KEV catalogue, underscoring a 2026 pattern in which exploits routinely beat patches to the wire. Defenders should prioritise EDR allowlisting, restrict SMB share usage and watch for spawned cmd.exe processes running as SYSTEM from unprivileged parents.
Reporting based on coverage from BleepingComputer, Cybernews, SecurityWeek, The Hacker News and ThreatLocker.