Microsoft Malware Protection Engine local privilege escalation fix (CVE-2026-50656) | MSSP Advisory

Risk Assessment

Microsoft patched CVE-2026-50656, a local privilege escalation flaw in the Microsoft Malware Protection Engine affecting Windows 10 and Windows 11, after a month-long gap between public disclosure and fix release. An unidentified researcher called Nightmare Eclipse published a working proof-of-concept exploit called RoguePlanet on June 10, and other researchers confirmed it functions as described. An authenticated attacker with low-complexity access can use this flaw to reach SYSTEM-level privileges on any unpatched machine running Windows Defender.

Every Windows endpoint your technicians touch through RMM sessions is a potential pivot point if this flaw is weaponized before the Malware Protection Engine auto-updates, and your own internal Windows machines running Defender are in the same boat. Your client advisory obligation is real here because Nightmare Eclipse has a documented pattern of releasing exploits that later get picked up by actual threat actors, and several prior releases from this researcher have already been used in the wild. If a client gets hit on a machine that had not yet received the engine update and you said nothing, that is a conversation you do not want to have.