Microsoft’s latest fixes matter because they line up two different ways into the same outcome: kernel-level code execution through HTTP.sys and a public proof of concept for a Defender engine privilege escalation. The standard local-EoP reading misses the bigger problem. Once an attacker gets a foothold, a trusted Windows helper can be steered into privileged work and turn that foothold into SYSTEM.
CSIRT-ITA says CVE-2026-50656, “RoguePlanet,” affects Microsoft Malware Protection Engine versions before 1.1.26060.3008 and has a public PoC. Zero Day Initiative says CVE-2026-47291 is a remote, unauthenticated HTTP.sys flaw that can lead to denial of service or, in the worst case, code execution with kernel privileges. Taken together, they widen the blast radius from a single product bug to a practical chain across Windows systems that expose HTTP.sys services or run Defender’s engine.
The risk is no longer just patching two separate bulletins. It is that remote access on a Windows host can now pair with a locally trusted security component to reach SYSTEM, which changes how defenders should judge exposure across servers and endpoints.
CVSS 9.8 CRITICAL: integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network. EPSS 25% (98th percentile), up from 1%. Microsoft patch: 5094123.
CVSS 7.8 HIGH: microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender… EPSS 11% (96th percentile), up from 0.4%. Microsoft patch: Release Notes.
Zero Day Initiative — CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys
In this excerpt of a TrendAI Research Services vulnerability report, Yazhi Wang and Jonathan Lein of the TrendAI Research team detail a recently patched remote code execution bug in the Windows HTTP protocol stack.
RoguePlanet: risolta la vulnerabilità in Microsoft Defender
Rilasciati aggiornamenti di sicurezza per risolvere la vulnerabilità CVE-2026-50656, nota con il nome “RoguePlanet” e per la quale risulta disponibile in rete un Proof of Concept (PoC), presente nel motore antimalware Microsoft Malware Protection Engine di Microsoft Defender.