RoguePlanet CVE-2026-50656 Named Pipe Creation for SYSTEM Callback

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•15

Detects the creation of or connection to the specific named pipe '\\pipe\\RoguePlanet', which is used as a synchronization and callback channel by the Nightmare Eclipse RoguePlanet exploit (CVE-2026-50656). This exploit leverages the named pipe to facilitate communication between a low-privileged exploit process and a SYSTEM-level Windows Error Reporting (WER) task payload during a local privilege escalation attempt.