[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fH4-sD455A-wfuIzu2JRxxKQAtYnuBV3pSjBX185G4H8":3},{"article":4,"iocs":47,"watch_terms":52,"solutions":53,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"803c6f17-d357-4a50-8d33-9b92b15ab726","Microsoft patches RoguePlanet Defender zero-day vulnerability","microsoft-patches-rogueplanet-defender-zero-day-vulnerability-3e97c1","Microsoft has released a security patch to address a Defender zero-day vulnerability known as \"RoguePlanet,\" disclosed after the June 2026 Patch Tuesday. [...]","Microsoft has released a patch for a zero-day vulnerability in Microsoft Defender, dubbed 'RoguePlanet' (CVE-2026-50656). The flaw, disclosed by researcher 'Nightmare Eclipse', allows attackers to gain SYSTEM privileges by exploiting a race condition. The researcher shared a proof-of-concept exploit and claims Microsoft has previously removed their repositories.","Microsoft patches RoguePlanet zero-day vulnerability in Defender after researcher disclosure.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fmicrosoft\u002Fmicrosoft-patches-rogueplanet-defender-zero-day-vulnerability\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F06\u002F17\u002FMicrosoft_Defender.jpg","2026-07-09T05:42:49+00:00","2026-07-09T06:00:18.894732+00:00",9,[17,20,23],{"name":18,"type":19},"Microsoft Defender","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"Nightmare Eclipse","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,42],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48],{"type":49,"value":50,"context":51},"cve","CVE-2026-50656","RoguePlanet zero-day vulnerability",[21,18],{"controls":54,"vendors":141},[55,84,112],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,96,104],{"vendor_slug":90,"vendor_name":21,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":113,"name":114,"problem":115,"products":116},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[142],{"slug":90,"name":21,"logo_path":91,"roles":143},[144],"affected",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":159},"microsoft-defender-zero-day-grants-system-privileges-via-race-condition","Microsoft Defender Zero-Day Grants SYSTEM Privileges via Race Condition","A zero-day vulnerability in Microsoft Defender, CVE-2026-50656 ('RoguePlanet'), was exploited through a race condition flaw that allowed attackers to escalate privileges to SYSTEM level — the highest on a Windows machine. This is particularly dangerous because Defender runs as a trusted security component, making exploitation both impactful and difficult to detect. The public release of a proof-of-concept exploit dramatically lowers the barrier for widespread attacks before organizations can patch. This incident also highlights tensions between security researchers and vendors, as the researcher alleged prior takedown of their work, which can deter responsible disclosure and delay coordinated patching.",[150,151,152,153,154,155,156,157,158],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Controlled Use of Administrative Privileges","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-6: Least Privilege","NIST IR-6: Incident Reporting","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","ISO\u002FIEC 27001:2022 Control 8.8: Management of Technical Vulnerabilities","ITIL Change Enablement: Emergency Change Procedures",{}]