[0xshadow]

The vulnerability features :

1. Local elevation‑of‑privilege (EoP) flaw in Microsoft Malware Protection Engine (MMPE)
   
2. Public alias: “RoguePlanet”
   
3. CWE‑59: Improper link resolution before file access (link‑following)
   
4. Privilege escalation: Grants SYSTEM‑level (administrator) rights in ~5 seconds
   
5. Low‑complexity attack: Exploits a race‑condition/TOCTOU once any code runs locally
   
6. Affected MMPE versions: 1.1.26050.11 – < 1.1.26060.3008 (e.g., 1.1.0.0‑1.1.26060.3007)
   
7. Supported OS: Windows 10, Windows 11 (client); issue also exists on Windows Server (PoC not functional)
   
8. CVSS 3.1 score: 7.8 (HIGH)
   
9. Mitigation: Update MMPE to 1.1.26060.3008 (July 8 2026) and keep Defender definitions current
   

[*]Vulnerability type: Local elevation‑of‑privilege (EoP) in Microsoft Malware Protection Engine (MMPE) used by Microsoft Defender
[*]Public name: “RoguePlanet”
[*]CWE: CWE‑59 – Improper link resolution before file access (link‑following)
[*]Impact: Low‑privileged user can gain SYSTEM‑level (administrator) privileges
[*]Attack vector: Local exploit; attacker needs initial code execution on the machine
[*]Complexity: Low – exploits a race‑condition/TOCTOU once code execution is available
[*]Affected versions: MMPE 1.1.26050.11 and any version < 1.1.26060.3008 (e.g., 1.1.0.0‑1.1.26060.3007)
[*]Platforms: Windows 10, Windows 11 (client) and Windows Server (issue present, PoC not working on Server)
[*]CVSS 3.1 base score: 7.8 (HIGH) 
[*] 

[*]We Accept Escrow Services
Session  : 052d3ad2aa0a31305ce80901638dc5e9197f58502de0da3eb3db96a5e2ee11384f