CVE-2026-50656: Microsoft Defender — SYSTEM Privilege Escalation Zero-Day (June 2026)

CVE-2026-50656 — Microsoft Defender

CVE-2026-50656 is a high-severity zero-day vulnerability in Microsoft Defender’s Malware Protection Engine, confirmed by Microsoft and actively exploited in the wild. The flaw allows attackers to escalate privileges to SYSTEM on fully patched Windows 10 and 11 systems. A public proof-of-concept exploit is available, and no patch has been released as of June 2026.

Attack Vector

Attackers exploit a race condition in the Malware Protection Engine, bypassing Defender’s real-time protection. Successful exploitation grants SYSTEM-level privileges, enabling arbitrary code execution with the highest permissions. No user interaction is required if the attacker can execute code on the target host. The exploit works on all supported Windows 10 and 11 client versions, regardless of recent security updates. Indicators of compromise are not specified, but exploitation is confirmed in the wild.

Who Is at Risk

All organizations running Microsoft Defender on Windows 10 and Windows 11 client systems are vulnerable. Microsoft has confirmed the issue affects all supported client Windows OS versions. Enterprises relying on Defender as their primary endpoint security solution are at elevated risk until a patch is released.

Patch & Mitigate

• Patch: No patch or hotfix is available as of June 2026. Microsoft is developing a fix; monitor official advisories for updates.
• Workaround: Consider temporarily disabling Defender where feasible and supplementing with alternative endpoint protection. Restrict local code execution and monitor for unusual privilege escalation attempts.
• Detect: Review endpoint logs for unexpected Defender service behavior, privilege escalation events, and anomalous process launches under SYSTEM context. Monitor for known proof-of-concept exploit signatures if available.

MITRE ATT&CK

• TA0004 — Privilege Escalation: Attackers leverage the race condition to gain SYSTEM privileges.
• TA0005 — Defense Evasion: Exploit bypasses Defender’s real-time protection, evading built-in security controls.

Source: https://securityaffairs.com/193830/security/microsoft-confirms-rogueplanet-zero-day-in-defender-patch-under-development.html