Microsoft released patches for CVE-2026-50656, a privilege escalation vulnerability in its Malware Protection Engine that attackers can exploit to gain SYSTEM-level access on Windows systems. The flaw, nicknamed RoguePlanet, carries a CVSS severity score of 7.8.
The vulnerability resides in mpengine.dll, the core component responsible for malware scanning, detection, and remediation across Microsoft Defender and related antivirus products. An attacker with local access to a target system can leverage this flaw to escalate privileges from a lower-level user account to SYSTEM, the highest privilege level on Windows.
This represents a meaningful security risk for organisations relying on Microsoft Defender as their primary antivirus solution. Once an attacker gains SYSTEM privileges, they obtain unrestricted control over the compromised machine. This enables installation of persistent malware, exfiltration of sensitive data, lateral movement within corporate networks, and deployment of ransomware or other destructive payloads.
Microsoft disclosed the patch nearly a month after technical details entered public circulation, extending the window during which threat actors could weaponise the flaw. Organisations running unpatched systems remain exposed during this post-disclosure period, particularly those with slower patch deployment cycles.
The vulnerability affects multiple Microsoft security products including Windows Defender, Microsoft Security Essentials, and related enterprise antivirus solutions. All users running affected versions must apply the latest security updates immediately. Administrators should prioritise deployment of this patch across their infrastructure, especially on systems handling sensitive data or critical operations.
For home users, Windows Update should deliver patches automatically if automatic updates remain enabled. Enterprise customers should verify deployment through their patch management systems and confirm that all endpoints running Microsoft's Malware Protection Engine receive the fix.