Windows Defender 0-Day Exploit
A researcher known as Nightmare Eclipse (also tracked as Chaotic Eclipse or Dead Eclipse) has publicly released a new proof-of-concept (PoC) exploit named RoguePlanet, targeting a previously undisclosed race condition vulnerability in Microsoft Windows Defender.
When successfully executed, the exploit spawns a command shell running under SYSTEM-level privileges, granting an attacker the highest possible access on a compromised Windows machine.
The release, posted to GitHub, arrives on Patch Tuesday, June 10, 2026, adding urgency to an already escalating series of Defender-targeting disclosures.
Windows Defender 0-Day Exploit “RoguePlanet”
RoguePlanet is a local privilege escalation (LPE) exploit that abuses a race condition within Microsoft Defender’s internal processing logic. A standard, unprivileged user can leverage the vulnerability to redirect a file operation performed by Defender, which runs as SYSTEM, in order to execute attacker-controlled code at the highest privilege level.
The exploit has been confirmed to work on fully patched Windows 10 and Windows 11 systems, including both the official stable and Canary Insider Preview channels, with the June 2026 patch applied.
Windows Server installations are also considered vulnerable, though the current PoC does not function in that environment because standard users cannot mount ISO images, a prerequisite of this specific exploit chain.
The underlying flaw is a Time-of-Check to Time-of-Use (TOCTOU) race condition, a class of vulnerability that Nightmare Eclipse previously exploited in the BlueHammer exploit (CVE-2026-33825) rated CVSS 7.8 (High) which was patched by Microsoft in April 2026.
In that earlier case, Defender’s file remediation engine performed privileged write operations without adequately locking down file path validation, enabling an attacker to insert NTFS junction points that redirected Defender’s SYSTEM-level writes into C:\Windows\System32.
