CVE-2026-50656
HIGHMicrosoft Defender Elevation of Privilege Vulnerability
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-50656. PoCs published by 0xBlackash.
AI-analyzed exploit summary The repository contains a C++ tool that checks for the presence of CVE-2026-50656, a TOCTOU vulnerability in Microsoft Defender's MsMpEng engine, by simulating race conditions with symbolic links. It does not exploit the vulnerability but detects potential susceptibility.
Description
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ". We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the update is available.
Exploits (1)
The repository contains a C++ tool that checks for the presence of CVE-2026-50656, a TOCTOU vulnerability in Microsoft Defender's MsMpEng engine, by simulating race conditions with symbolic links. It does not exploit the vulnerability but detects potential susceptibility.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H