CVE-2026-50656: exploitation status and patch state

CVE-2026-50656 · CVSS 7.8 HIGH · EPSS 11% · patch available

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".

Is CVE-2026-50656 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 11%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Microsoft · Microsoft Malware Protection Engine · >= 1.1.0.0, < 1.1.26060.3008

Is there a patch?

Yes. Update to one of these or later:

From Microsoft's CVE record · Microsoft advisory

• Release Notes

From Microsoft's Security Update Guide · Microsoft advisory

What PlainSec published about CVE-2026-50656

• Defender cloud scan opens a SYSTEM path (2026-08-13)
• Windows now has a remote-to-SYSTEM path (2026-07-10)

Primary sources

• NVD record
• Microsoft advisory

KEV and EPSS are re-checked daily. Record last updated 2026-10-25.