Microsoft works on patch for RoguePlanet zero-day abusing Defender race condition

Intelligence Summary

Public proof-of-concept code for the RoguePlanet zero-day targets a race condition in Microsoft Defender. The flaw can be used to spawn a command prompt running with System privileges. This increases the risk of local privilege escalation and potential takeover of affected endpoints. Microsoft is working on a patch, but users should treat systems as exposed until mitigations land. Organizations should review Microsoft guidance, ensure Defender is up to date, and monitor for suspicious command execution behavior.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics