SecPod Webinars

Two Microsoft Defender privilege-escalation vulnerabilities. One patched. One still exposed at the time of analysis.

RoguePlanet (CVE-2026-50656) and ShieldBreak (CVE-2026-69414) abuse Microsoft Defender’s SYSTEM-level remediation process to write attacker-controlled files to protected locations.

Early reporting blurred the distinction between the two vulnerabilities, creating the risk of false patching and compliance conclusions.

This technical webinar separates the two CVEs and examines how each exploit works, why the RoguePlanet patch was bypassed within 34 days, and how attackers could chain these vulnerabilities with phishing or ClickFix-style initial access to gain SYSTEM privileges, evade defenses, access credentials, and deploy ransomware.