RoguePlanet CVE-2026-47281 Defender race condition grants SYSTEM, defeats June fix on Windows 10 and 11
A Windows zero-day called RoguePlanet lets an attacker who already has a foothold take SYSTEM-level control, and researchers say it still works on Windows 10 and 11 that installed this month's patches. It abuses a timing race in Microsoft $MSFT Defender. Active exploitation is co
Anyone running Windows 10 or 11 should know that installing this month's security updates may not close one specific hole. A zero-day vulnerability nicknamed RoguePlanet, tracked as CVE-2026-47281 and rated 9.6 on the severity scale, lets an attacker who already has a basic foothold on a machine escalate all the way to SYSTEM, the highest level of control Windows offers. According to security researchers, the exploit continues to work against fully patched systems, including those that received the June Patch Tuesday updates that were meant to address it. The weakness sits inside Microsoft $MSFT Defender, the antivirus built into Windows. It abuses a timing flaw, a so-called race condition, in the way Defender processes files during its quarantine routine. Because the exploit depends on winning that race, success is probabilistic and varies by hardware, but an attacker who has already gained entry can keep retrying until it works. The technique was published by a researcher using the alias MSNightmare, linked to a group calling itself Nightmare Eclipse, and active exploitation has been confirmed. Microsoft has said it is investigating. For now the practical takeaway is exposure management: limit how attackers gain that initial foothold, since the privilege jump that follows is hard to block.