Vulnerabilities · 125 days ago
Microsoft’s latest fixes matter because they line up two different ways into the same outcome: kernel-level code execution through HTTP.sys and a public proof of concept for a Defender engine privilege escalation. The standard local-EoP reading misses the bigger problem. Once an attacker gets a foothold, a trusted Windows helper can be steered into privileged work and turn that foothold into SYSTEM.
CSIRT-ITA says CVE-2026-50656, “RoguePlanet,” affects Microsoft Malware Protection Engine versions before 1.1.26060.3008 and has a public PoC. Zero Day Initiative says CVE-2026-47291 is a remote, unauthenticated HTTP.sys flaw that can lead to denial of service or, in the worst case, code execution with kernel privileges. Taken together, they widen the blast radius from a single product bug to a practical chain across Windows systems that expose HTTP.sys services or run Defender’s engine.
The risk is no longer just patching two separate bulletins. It is that remote access on a Windows host can now pair with a locally trusted security component to reach SYSTEM, which changes how defenders should judge exposure across servers and endpoints.
CVSS 9.8 CRITICAL: integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network. EPSS 25% (98th percentile), up from 1%. Microsoft patch: 5094123.
Patch available KB5094123 Download →
CVSS 7.8 HIGH: microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender… EPSS 11% (96th percentile), up from 0.4%. Microsoft patch: Release Notes.
8 sources covering this story
Zero Day Initiative — CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys
In this excerpt of a TrendAI Research Services vulnerability report, Yazhi Wang and Jonathan Lein of the TrendAI Research team detail a recently patched remote code execution bug in the Windows HTTP protocol stack.
RoguePlanet: risolta la vulnerabilità in Microsoft Defender
Rilasciati aggiornamenti di sicurezza per risolvere la vulnerabilità CVE-2026-50656, nota con il nome “RoguePlanet” e per la quale risulta disponibile in rete un Proof of Concept (PoC), presente nel motore antimalware Microsoft Malware Protection Engine di Microsoft Defender.
Patch for Windows Defender 0-day could allow attackers to fill hard disk
The feud between NightmareEclipse and Microsoft shows no signs of resolving soon.
Microsoft Reins in RoguePlanet Zero-Day Threat
The researcher known as "Nightmare-Eclipse" published a proof-of-concept (PoC) exploit for the Windows Defender vulnerability in early June.
Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656) - Help Net Security
Microsoft has finally released a fix for CVE-2026-50656, the Windows Defender LPE vulnerability triggered by the RoguePlanet exploit.
Microsoft Patches Defender ‘RoguePlanet’ Vulnerability
The privilege escalation vulnerability tracked as CVE-2026-50656 has been patched with a Microsoft Malware Protection Engine update.
Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges
Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges | Read more hacking news on The Hacker News cybersecurity news website and learn how to protect against cyberattacks and software vulnerabilities.
Microsoft patches RoguePlanet Defender zero-day vulnerability
Microsoft has released a security patch to address a Defender zero-day vulnerability known as
Part of the PlainSec briefing for 2026-07-10