Windows Defender <= 1.1.26050.11 Elevation of Privilege (RoguePlanet) (CVE-2026-50656)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(326451);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/14");

  script_cve_id("CVE-2026-50656");

  script_name(english:"Windows Defender <= 1.1.26050.11 Elevation of Privilege (RoguePlanet) (CVE-2026-50656)");

  script_set_attribute(attribute:"synopsis", value:
"An antimalware application installed on the remote host is affected by an elevation of privilege vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Malware Protection Engine version of Microsoft Windows Defender installed on the remote Windows host is prior to or
equal to 1.1.26050.11. It is, therefore, affected by an elevation of privilege vulnerability:

  - Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker
    to elevate privileges locally. This vulnerability is publicly referred to as RoguePlanet. (CVE-2026-50656)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656");
  script_set_attribute(attribute:"see_also", value:"https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day");
  script_set_attribute(attribute:"solution", value:
"Enable automatic updates to update the malware engine for the relevant antimalware applications. Refer to Knowledge Base
Article 2510781 for information on how to verify that MMPE has been updated.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-50656");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"in_the_news", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/13");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:windows_defender");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("microsoft_windows_defender_win_installed.nbin");
  script_require_keys("installed_sw/Windows Defender");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app = 'Windows Defender';

var app_info = vcf::get_app_info(app:app, win_local:TRUE);

if (!isnull(app_info['Disabled']))
  exit(0, 'Windows Defender is disabled.');

if (isnull(app_info['Engine Version']))
  exit(0, 'Unable to get the Malware Engine Version.');

var constraints = [{'max_version': '1.1.26050.11', 'fixed_version': '1.1.26060.3008'}];

vcf::av_checks::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING, check:'Engine Version');