Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows

The anonymous security researcher going by the name Chaotic Eclipse (aka Nightmare-Eclipse) has released a proof-of-concept (PoC) exploit for yet another Microsoft Defender zero-day named RoguePlanet. "The exploit is a race condition, so it's a hit or miss," the researcher, who published the exploit under a new GitHub account, "MSNightmare" said. "I have managed to get a 100% success rate on

The report describes a Microsoft Defender zero-day named RoguePlanet, released as a proof-of-concept exploit by a researcher known as Chaotic Eclipse, that can sometimes escalate an attacker to SYSTEM privileges on updated Windows 10 and Windows 11 machines. The article says the exploit is race-condition based and was not yet workable on Windows Server in its current form, though the researcher stated Server is still vulnerable. CyberSE.AI assessment: this is not an AI-specific issue, but it is a high-severity endpoint security risk because successful exploitation could let an attacker run arbitrary code with full local control on affected systems.