We finally have an official response. Microsoft confirmed it is actively building a patch for RoguePlanet, a fascinating new zero-day exploit targeting Windows 10 and 11. If you haven’t tracked the cybersecurity space lately, a researcher going by the alias Nightmare Eclipse has dropped an unbroken chain of Windows vulnerabilities since April 2026. This release is their sixth.
The code hit GitHub immediately following Microsoft’s June 2026 Patch Tuesday updates. A company spokesperson confirmed they are investigating the validity of the exploit and are committing to update all impacted products.
What We Know
- RoguePlanet abuses the timing of Microsoft Defender’s real-time quarantine pipeline.
- Threat research teams at Cyderes and SOC Prime successfully verified the attack chain in laboratory tests on fully patched Windows 11 Pro systems.
- The exploit grants an attacker the absolute highest administrative privileges possible on a machine (NT AUTHORITY\SYSTEM).
- Windows Server environments remain unaffected because standard server users lack the permissions required to mount the specific ISO file needed for the attack.
The history behind this code is just as interesting as the exploit itself. RoguePlanet originally started as a Remote Code Execution tool. Microsoft actually pushed a routine Defender engine update back in May 2026 that accidentally broke the original attack vector. Instead of giving up, the author completely rewrote the code into a Local Privilege Escalation exploit.
It works completely independent of whether Defender’s real-time protection is toggled on or off. But there is a catch regarding its reliability. Nightmare Eclipse admitted the code is a “hit or miss” endeavor. It executes flawlessly on some computers but fails on others simply due to microscopic timing differences in the hardware.
How RoguePlanet Outsmarts the Scanner
This unpredictability happens because RoguePlanet relies on a “Time-of-Check to Time-of-Use” race condition. It is a highly specific category of software flaw. Defender scans a suspicious file and determines it is safe. In the exact millisecond between the scan finishing and the operating system using that file, the attacker swaps the safe data with malicious instructions.
The attacker literally races the antivirus software. The fact that researchers are verifying this attack without relying on traditional memory corruption shows how creative these bypass methods are becoming. Until Microsoft pushes the finalized patch, Windows 10 and 11 systems remain exposed to anyone who can win that exact millisecond race.