CVE-2026-50656 PoC: Microsoft Defender RoguePlanet elevation-of-privilege patch bypass
github.com | vulnerability | High | CVE-2026-50656 | #zero-day | #public-poc | #privilege-escalation | #windows-security | #windows | #defender | #patch-bypass | #cwe-59 | #poc | #microsoft-defender | #cve-2026-50656
Summary
ShieldBreak, a public PoC for CVE-2026-50656, claims a full bypass of Microsoft's RoguePlanet patch—an elevation-of-privilege flaw in the Malware Protection Engine—on Windows 11 25H2 and Server 2025.
Why it matters
The repository publishes a patch-bypass implementation for a Defender elevation-of-privilege flaw, increasing practical risk to affected endpoints. Administrators should update the Malware Protection Engine to a fixed version and validate the PoC only in an explicitly authorized isolated environment; public availability does not by itself confirm exploitation in the wild.
- CVE
- CVE-2026-50656
- Vendor
- Microsoft
- Product
- Microsoft Malware Protection Engine / Microsoft Defender
- Affected versions
- Microsoft Malware Protection Engine versions before 1.1.26060.3008; repository reports Windows 11 25H2 Canary and Windows Server 2025 testing, with Windows 10 vulnerable but unsupported by this PoC
- CVSS
- 7.8
- Published
- Collected
--- id: 6556 title: "CVE-2026-50656 PoC: Microsoft Defender RoguePlanet elevation-of-privilege patch bypass" cve: CVE-2026-50656 cvss: 7.8 severity: high vendor: "Microsoft" product: "Microsoft Malware Protection Engine / Microsoft Defender" affected_versions: "Microsoft Malware Protection Engine versions before 1.1.26060.3008; repository reports Windows 11 25H2 Canary and Windows Server 2025 testing, with Windows 10 vulnerable but unsupported by this PoC" source_domain: github.com source_url: "https://github.com/MSNightmare/ShieldBreak" published_at: "2026-08-11T19:35:37Z" tags: ["zero-day", "public-poc", "privilege-escalation", "windows-security", "windows", "defender", "patch-bypass", "cwe-59", "poc", "microsoft-defender", "cve-2026-50656"] phying_url: "https://phying.com/item/6556" lang: en --- # CVE-2026-50656 PoC: Microsoft Defender RoguePlanet elevation-of-privilege patch bypass ## Summary ShieldBreak, a public PoC for CVE-2026-50656, claims a full bypass of Microsoft's RoguePlanet patch—an elevation-of-privilege flaw in the Malware Protection Engine—on Windows 11 25H2 and Server 2025. ## Why it matters The repository publishes a patch-bypass implementation for a Defender elevation-of-privilege flaw, increasing practical risk to affected endpoints. Administrators should update the Malware Protection Engine to a fixed version and validate the PoC only in an explicitly authorized isolated environment; public availability does not by itself confirm exploitation in the wild. ## Intelligence Metadata - **Sources:** github.com - **CVE:** CVE-2026-50656 - **CVSS:** 7.8 - **Vendor:** Microsoft - **Product:** Microsoft Malware Protection Engine / Microsoft Defender - **Affected versions:** Microsoft Malware Protection Engine versions before 1.1.26060.3008; repository reports Windows 11 25H2 Canary and Windows Server 2025 testing, with Windows 10 vulnerable but unsupported by this PoC - **Published:** 2026-08-11T19:35:37Z - **Original:** https://github.com/MSNightmare/ShieldBreak - **Phying News:** https://phying.com/item/6556