Microsoft warns of Defender flaw as NightmareEclipse feud escalates

Microsoft has assigned CVE-2026-50656 to a Microsoft Defender flaw it publicly calls RoguePlanet, saying the bug can let an authorized attacker elevate privileges locally through improper link resolution before file access, or “link following.” The company classifies it as an Important-severity elevation-of-privilege issue with a CVSS base score of 7.8, and says it is working on a security update.

The flaw sits in Microsoft Defender and the Microsoft Malware Protection Engine, which means it affects systems that rely on Microsoft’s built-in malware scanning stack. Microsoft says systems with Defender disabled are not in an exploitable state, but for the many households and organizations that leave it enabled, the issue matters because a local privilege-escalation bug can turn an already compromised account or foothold into broader control over a machine.

Microsoft’s advisory says the vulnerability requires customer action to resolve, a signal that the fix has not been fully delivered through routine maintenance yet. The CVE was publicly disclosed on June 16, 2026, and Microsoft updated its advisory on July 8, 2026, as pressure around the flaw and its handling intensified.

The new disclosure also widens a feud with NightmareEclipse, the researcher tied to a run of public Windows exploit releases in recent months. That pattern has included repeated releases of unpatched Windows vulnerabilities and criticism of Microsoft’s disclosure handling, putting extra weight on how quickly Microsoft can close the gap once a flaw is named. In this case, speed matters because the bug is not a remote takeover flaw on its face, but a local privilege-escalation issue that can still be highly valuable to attackers who already have a foothold.

For households, the urgency is straightforward: once Microsoft ships the fix, the update should not wait. For enterprise IT teams, the stakes are higher because a local elevation-of-privilege bug in security software can be used to move from limited access to administrative-level control, especially across large fleets where one missed machine can become a path deeper into the network. Microsoft has said it is aware of the problem and is working on a high-quality security update, but until that lands, RoguePlanet remains a live accountability test for both the vendor and the researcher.