RoguePlanet zero-day turns Microsoft Defender against fully updated Windows PCs
A security researcher released a working exploit called RoguePlanet that abuses Microsoft $MSFT Defender, the built-in antivirus on Windows 10 and 11, to gain full system-level control on fully updated machines. Microsoft has confirmed the flaw and rated it important, but has not
The antivirus built into Windows can now be turned into a way to take over the machine. A security researcher released a working exploit called RoguePlanet that targets Microsoft $MSFT Defender, the built-in antivirus on Windows 10 and Windows 11. The flaw lets a local attacker quietly gain full system-level control, the highest level of access on a Windows machine, and it works on fully updated computers. The exploit appeared just hours after Microsoft's June security updates went out, and it abuses a timing flaw in how Defender scans files in real time. Microsoft has confirmed the vulnerability and rated it important, and says it is working on a high-quality patch, but none has shipped yet. Security teams warn that ransomware groups value this kind of access, because it can turn a single foothold into control of an entire network. For now, defenders are limiting who can run code on their systems and watching closely. The next step to watch is Microsoft's official fix.