A zero-day vulnerability in Microsoft Defender, dubbed 'RoguePlanet', is under active exploitation, allowing attackers to escalate privileges to SYSTEM level. The flaw bypasses standard security controls, posing a significant risk to enterprise environments where Defender is widely deployed.
The vulnerability carries a CVSS score of 7.8, indicating high severity. Security researchers at BleepingComputer report that the flaw is being actively exploited in the wild, though Microsoft has not yet confirmed the scope of affected systems. Initial indicators suggest widespread impact across Windows 10, Windows 11, and Windows Server installations.
Attackers exploit the vulnerability by crafting a malicious file that triggers a heap-based buffer overflow within Defender's scanning engine. Successful exploitation grants SYSTEM privileges, enabling full compromise of the target host. Indicators of compromise include unusual access patterns to Defender's process memory and unexpected service crashes.
Microsoft has released an out-of-band patch via Windows Update. Users are advised to apply updates immediately. For systems unable to patch, disabling real-time scanning temporarily is a workaround, though this reduces protection. The vendor recommends enabling attack surface reduction rules as a compensating control.
Attribution remains unconfirmed, but the exploit's sophistication suggests state-sponsored or advanced persistent threat actors. This incident underscores the growing trend of attackers targeting endpoint security solutions themselves to gain elevated access.