GreatXML to RoguePlanet: The Zero-Days Redefining Endpoint Security in 2026

June 2026 delivered a wake-up call for endpoint security: two back-to-back zero-days — GreatXML and RoguePlanet — turned Microsoft Defender itself into the attack vector. When the antivirus becomes the exploit, the security model needs rethinking.

The Zero-Day Landscape Is Shifting

Attackers are no longer hunting for application bugs — they’re weaponizing the tools designed to protect us. GreatXML and RoguePlanet, landing back-to-back in June 2026, prove the point: both target Microsoft Defender, and both reach SYSTEM. The same cycle brought five more critical items — ShinyHunters’ PeopleSoft zero-day, an exploited Langflow RCE, the OnyxC2 infostealer, and urgent Splunk/Palo Alto patches — making this one of the densest endpoint patch weeks of the year.

GreatXML: When a Data Format Becomes a Weapon

GreatXML takes an elegant but devastating approach: instead of a traditional memory-corruption bug, it abuses Microsoft Defender’s own offline scanning mechanism to achieve SYSTEM-level code execution.

1. A crafted XML payload triggers Defender’s offline scan during Windows Recovery Mode boot
2. The XML exploits a parser vulnerability in Defender’s scanning engine
3. Defender’s trusted process spawns a SYSTEM-level shell
4. Full machine compromise — no click, no download, no user interaction

The elegant part is the delivery: XML is a universally trusted format that passes through email gateways, web applications, and file systems without suspicion, making detection far harder than executable-based attacks. And the failure mode is philosophical: the antivirus — the last line of defense — is the attack vector. Organizations relying solely on Defender without application whitelisting or behavioral detection are structurally exposed.

RoguePlanet: A Logic Flaw That Grants SYSTEM

Hot on GreatXML’s heels, researchers disclosed RoguePlanet — released just hours after June Patch Tuesday fixed two previously disclosed Defender vulnerabilities. It grants SYSTEM privileges via a logic flaw in Defender’s real-time protection subsystem

Unlike memory corruption, logic flaws are architectural: they exist because the system trusts operations that shouldn’t be trusted. They can’t be fixed by a compiler hardening flag — only by redesign of the trust boundary, which is why this class keeps returning.

The 2026 Zero-Day Pattern

The meta-lesson: 2026’s zero-days are about finding trust boundaries, not just bugs. For the wider monthly context, see the June threat landscape briefing.

Five More Threats in the Same Cycle

• ShinyHunters × Oracle PeopleSoft (CVE-2026-35273) — zero-day exploited against the University of Nottingham, leaking 450,000+ records; Oracle has issued mitigations but hasn’t confirmed exploitation status
• Langflow RCE — unauthenticated remote code execution in the AI workflow platform, disclosed in March and now actively exploited; internet-facing instances must be updated or isolated
• OnyxC2 Stealer — enterprise-grade infostealer targeting 200+ applications via encrypted payloads, DLL sideloading, and in-memory execution
• Splunk & Palo Alto criticals — both patched severe flaws allowing arbitrary file creation and protected resource modification
• Microsoft Exchange (CVE-2026-42897) — exploited in the wild since May 14, now patched

This Week’s Priority Actions

1. Apply June Patch Tuesday immediately — Defender fixes and Exchange CVE-2026-42897 above all
2. Re-layer endpoint defense — application control constraining even Defender’s processes; behavioral detection alongside signature engines
3. Alert on anomalous XML processing — mass XML creation or unusual parse activity
4. Patch Splunk and Palo Alto — both fixes are severe and fresh
5. Isolate or update Langflow — every internet-facing AI workflow instance
6. Apply PeopleSoft mitigations — then verify with external scanning
7. Brief the SOC on device code phishing — detections are up 37x; our device code phishing breakdown covers the signals

Frequently Asked Questions

What is the GreatXML zero-day?

A June 2026 zero-day that abuses Microsoft Defender’s offline scanning mechanism. A crafted XML payload triggers Defender’s offline scan during Windows Recovery Mode boot, exploits a parser vulnerability in the scanning engine, and turns Defender’s trusted process into a SYSTEM-level shell — no user interaction required. Patch via June Patch Tuesday; layer application control and behavioral detection beyond any single engine.

What is RoguePlanet?

A second Defender zero-day disclosed hours after June Patch Tuesday. It exploits a logic flaw in Defender’s real-time protection subsystem to gain SYSTEM privileges. Logic flaws are architectural rather than memory-related, which makes them harder to eradicate — the fix is redesigning the trust boundary, not adding bounds checks.

Why are attackers targeting security tools in 2026?

Because compromise of a security tool grants trusted-system access by definition: its processes are allowed everywhere, its telemetry can be blinded, and defenders instinctively trust its output. As memory safety has improved across the ecosystem, attackers pivoted to the most privileged, most trusted code on the endpoint — the AV/EDR stack itself.

What should I patch first this cycle?

June Patch Tuesday (Defender fixes plus Exchange CVE-2026-42897, exploited since May 14), then Splunk and Palo Alto criticals, then Langflow RCE exposure, then PeopleSoft mitigations. If forced to sequence further: anything internet-facing first, exploited-in-the-wild before theoretical, then internal trust-boundary fixes.

References

• Microsoft — June 2026 Patch Tuesday security updates
• Oracle — PeopleSoft CVE-2026-35273 mitigation guidance
• Splunk & Palo Alto — critical security advisories, June 2026
• Hmmnm — Cybersecurity Threat Landscape June 2026
• Hmmnm — Device Code Phishing 2026: The 37x MFA Bypass
• Hmmnm — Chrome Zero-Day & PyPI Supply Chain Attacks
• Hmmnm — Defender Becomes the Door: Triple Zero-Day
• Hmmnm — Zero-Day Surge 2026