A security researcher using the name Chaotic Eclipse (also known as Nightmare-Eclipse) has published a proof-of-concept exploit called “RoguePlanet,” described as a Microsoft Defender zero-day. Multiple outlets report the flaw works against fully patched Windows 10 and 11 systems and can elevate privileges to obtain a SYSTEM-level command prompt by leveraging a race condition in Defender’s handling of certain files. The researcher released the PoC shortly after Microsoft’s June Patch Tuesday update, which included fixes for other previously disclosed vulnerabilities.
Reports state the exploit was published in a self-hosted repository after Microsoft removed earlier public hosting for the researcher’s materials. The researcher says exploitation can be inconsistent because it is timing-dependent, though they claim high success on some systems. Threat intelligence testing cited by one outlet says the flaw was reproduced on fully patched Windows 11 (including KB5094126) and that allowlisting can help prevent the exploit from running.
One account also provides context that the researcher originally developed the issue as a remote code execution vulnerability involving coerced interaction with remote SMB share content and that later changes may have shifted the practical outcome toward local privilege escalation, with remaining uncertainty about alternative paths to remote code execution.
