RoguePlanet VSS wermgr.exe Access for Oplock Placement (CVE-2026-50656)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects unauthorized access to wermgr.exe residing within Volume Shadow Copy paths or staged in specific temp directories. This behavior is associated with the RoguePlanet exploit, which uses this pattern to obtain SYSTEM-readable handles for subsequent oplock placement and TOCTOU (Time-of-Check Time-of-Use) race conditions to achieve privilege escalation.