A defiant security researcher released a working exploit for a new Windows zero-day just hours after Microsoft’s record-breaking June 2026 Patch Tuesday — and it runs on fully patched systems.
June 9, 2026 was supposed to be a good day for Windows security. Microsoft pushed out its largest Patch Tuesday in the program’s 23-year history — 208 CVEs in a single update cycle, including fixes for three previously disclosed Microsoft Defender flaws. Security teams were scrambling to triage and deploy. Then, that same afternoon, a proof-of-concept exploit called RoguePlanet appeared online, targeting a brand-new vulnerability in Microsoft Defender that none of those 208 fixes addressed.
The researcher behind it goes by Nightmare Eclipse (also known as Chaotic Eclipse), and the message was unmistakable: Microsoft can patch faster, but this researcher intends to stay ahead.
What RoguePlanet Does — and How It Works
RoguePlanet exploits a race condition in Microsoft Defender to spawn a command prompt with SYSTEM-level privileges on Windows 10 and Windows 11 machines. SYSTEM is the highest privilege level on a Windows machine — above even Administrator — giving an attacker the ability to run arbitrary code, install software, modify or delete files, create new user accounts, and disable security controls entirely.
The exploit works by abusing the way Defender handles files on remote SMB (Server Message Block) shares. In its original form, the researcher says, the vulnerability was a full remote code execution flaw: an attacker could coerce a victim into mounting a malicious .vhd or .vhdx file from a remote SMB share, causing Defender to overwrite its own files and execute attacker-controlled code in the process.
Microsoft partially closed that door in mid-May by quietly hardening the mpengine!SysIO* API, blocking the junction-based attack path. But Nightmare Eclipse rewrote the exploit to work around those changes, pivoting the attack to a Local Privilege Escalation (LPE) — still dangerous, still fully functional, and still unpatched as of this writing.
The researcher has been transparent about the exploit’s limitations. “It’s a race condition, so it’s hit or miss,” Nightmare Eclipse wrote in the exploit’s repository. “I have managed to get a 100% success rate on some machines while it struggled to work on others.” That variability depends on system hardware and load, but independent testers have confirmed it works.
Cybersecurity firm ThreatLocker reproduced the exploit in-house against a fully patched Windows 11 system with KB5094126 installed — the June Patch Tuesday update — and confirmed it succeeded. ThreatLocker CEO Danny Jenkins said in a statement: “Our initial analysis confirms that the RoguePlanet exploit is viable and performs as described. Organizations using application allowlisting can prevent the exploit from executing, providing an effective layer of protection against this attack.”
Security researcher Will Dormann corroborated this independently, noting on Mastodon that the exploit worked for him on the first attempt, despite its race-condition nature.
A Researcher at War With Microsoft
RoguePlanet does not exist in isolation. It is the latest chapter in a prolonged and increasingly bitter dispute between Nightmare Eclipse and Microsoft — a dispute that has reshaped how the security community is thinking about vulnerability disclosure norms.
Since April 2026, this single anonymous researcher has publicly released at least six Windows zero-day exploits. The series includes BlueHammer (CVE-2026-33825), UnDefend (CVE-2026-45498), RedSun (CVE-2026-41091), GreenPlasma, YellowKey, and now RoguePlanet. Microsoft fixed GreenPlasma and YellowKey in the very Patch Tuesday that RoguePlanet dropped alongside — a point the researcher appears to have timed deliberately.
According to signed blog posts from Nightmare Eclipse, the dispute stems from Microsoft’s handling of the researcher’s original vulnerability reports. The researcher alleges Microsoft revoked access to their Microsoft Security Response Center (MSRC) account, dismissed or ignored submitted reports, refused to pay bug bounty rewards for valid vulnerabilities, and ultimately attempted to defame them. In the researcher’s view, public disclosure became the only remaining lever.
Microsoft’s response has been measured but firm. The company condemned the disclosures as “never justifiable,” warning that they put customers at “unnecessary risk.” Microsoft also moved to remove Nightmare Eclipse’s repositories from GitHub and GitLab. The researcher’s latest releases now live on a self-hosted platform, projectnightcrawler.dev, specifically to stay out of Microsoft’s reach.
In a statement posted to X (formerly Twitter), Microsoft’s security response team wrote: “We have no intention to pursue action against individuals conducting or publishing their security research. When an individual breaks the law and engages in malicious activity causing real harm to our customers, we will work with law enforcement as appropriate.”
That statement was widely criticized in the security community as deliberately ambiguous — a veiled threat, in the eyes of many researchers, against legitimate security work.
Prominent security researcher Kevin Beaumont summed up the sentiment bluntly: “Microsoft is attempting to misuse its ownership of GitHub to protect only its own products, and misuse its extensive links to law enforcement by branding publishing information about vulnerabilities in its own products as criminal behaviour.”
The Broader Implications for Windows Security
The RoguePlanet saga is forcing the enterprise security community to grapple with some uncomfortable realities.
First, the speed of disclosure is accelerating. The gap between a patch being shipped and a new exploit appearing in the wild used to be measured in days or weeks. Nightmare Eclipse compressed that gap to hours — on the same day, for the same product. Security teams that planned to deploy June’s patches over a standard two-week rollout window may need to reconsider that timeline.
Second, Microsoft Defender itself is now a high-value attack surface. Multiple exploits in this series specifically target the antivirus engine that is supposed to be a last line of defense. Ironically, having Defender active is a prerequisite for some of these attacks to work. Defender still blocks far more threats than it introduces, but the optics are damaging.
Third, the bug bounty ecosystem has a trust problem. When a researcher with a stack of valid vulnerabilities — and a willingness to demonstrate them publicly — claims that Microsoft failed to engage fairly, the implications ripple outward. Other researchers are watching. At least one additional researcher has begun releasing Microsoft exploits in apparent solidarity with Nightmare Eclipse’s stance, according to reporting from The Register.
What Organizations Should Do Right Now
Despite the race-condition reliability issues, RoguePlanet represents a real and active threat. The consensus guidance from security vendors is:
Apply the June 2026 Patch Tuesday updates immediately. While they do not fix RoguePlanet, they do fix 208 other vulnerabilities including three zero-days under active exploitation. Delaying makes the overall attack surface worse.
Implement application allowlisting. ThreatLocker and other vendors confirm that allowlisting prevents the RoguePlanet payload from executing even when the race condition succeeds. This is one of the most effective mitigations available until Microsoft issues a dedicated patch.
Monitor for SYSTEM-level process spawning from Defender-related processes. The exploit’s telltale sign is an unexpected command prompt or shell process with SYSTEM privileges originating from Defender components. SIEM rules and EDR detections should be updated accordingly.
Don’t rely on patching alone. The pace at which new zero-days are emerging in this campaign — one every two to three weeks since April — means that a patch-centric security strategy is insufficient. Defense in depth is no longer optional.
Microsoft has confirmed it is “actively investigating” RoguePlanet. A patch, when it arrives, will likely come as an out-of-band update rather than waiting until July’s Patch Tuesday. In the meantime, the clock is ticking — and somewhere, Nightmare Eclipse is reportedly sitting on more.
Sources: BleepingComputer, The Hacker News, SecurityWeek, ThreatLocker, Qualys Security Blog
