Story perspectives

Microsoft Issues Emergency Defender Update Fixing Privilege-Escalation Zero-Day

7/10/2026

Summary

Story summary

Microsoft issued an out-of-cycle update (Malware Protection Engine 1.1.26060.3008) for Defender zero-day CVE-2026-50656.
The patch fixes a privilege-escalation flaw in mpengine.dll that could spawn a command prompt even with protection off.
Nightmare Eclipse disclosed the bug in June 2026, posted proof-of-concept code, and said it affected patched Windows 10 and 11 machines.
Microsoft said engine updates install automatically, require no user action, and close the seventh public zero-day researcher reported this year.

1 of 1

Story summary

Microsoft issued an out-of-cycle update (Malware Protection Engine 1.1.26060.3008) for Defender zero-day CVE-2026-50656.
The patch fixes a privilege-escalation flaw in mpengine.dll that could spawn a command prompt even with protection off.
Nightmare Eclipse disclosed the bug in June 2026, posted proof-of-concept code, and said it affected patched Windows 10 and 11 machines.
Microsoft said engine updates install automatically, require no user action, and close the seventh public zero-day researcher reported this year.