Reported by 6 outlets

Timeline

1. original reporting

   Microsoft Defender 'ShieldBreak' zero-day grants SYSTEM privileges

   bleepingcomputer.com · 62d ago · August 12th, 2026

   A security researcher known as Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named " ShieldBreak " after Microsoft released the August 2026 Patch Tuesday security updates. The new vulnerability is described as a bypass for RoguePlanet , another Defender privilege escalation flaw disclosed in June and patched by Microsoft one month later. As Nightmare Eclipse explained, ShieldBreak can be used to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. "Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass," they said . "The PoC was tested in the latest version of windows 11 25h2 (+Canary channel) and windows server 2025, the PoC also have a 100% success rate. Please note that Windows 10 (and respective server editions) are not currently supported, they are however vulnerable to ShieldBreak as well." Will Dormann, principal vulnerability analyst at Tharros, confirmed on Tuesday that the exploit works, saying that Microsoft Defender needs to be enabled for the ShieldBreak exploit to escalate attackers' privileges. ShieldBreak PoC exploit demo (Nightmare Eclipse) The ShieldBreak exploit is part of an ongoing and heated dispute between Microsoft and Nightmare Eclipse over the company's vulnerability disclosure and bug bounty practices. Microsoft responded to Nightmare Eclipse's disclosures with warnings of legal

2. update from securityweek.com

   Nightmare Eclipse Drops 'LegacyHive' — Unpatched Windows User Profile Service LPE

   securityweek.com · 90d ago · July 16th, 2026

   The disgruntled security researcher known as Nightmare Eclipse (aka Chaotic Eclipse) has released another unpatched Windows zero-day, timed to coincide with the July 2026 Patch Tuesday. LegacyHive is a local privilege escalation vulnerability in the Windows User Profile Service that allows an attacker to mount another user's NT registry hive — including administrator hives — into the current user's classes root. The PoC requires another standard user's credentials and a target username (e.g., an admin), and works on systems running Microsoft's July 2026 patches. Unlike previous drops (BlueHammer, RedSun, UnDefend, GreatXML), LegacyHive was released with a stripped PoC to slow weaponization. The researcher states the exploit originally required no credentials and could load any hive — capabilities that are still possible with additional work. This is the eighth+ zero-day Nightmare Eclipse has released targeting Microsoft products, with previous exploits confirmed used in real attacks. Action: Monitor for exploitation of User Profile Service manipulation. The strip-down of the PoC slows but does not prevent weaponization by determined actors.

3. update from cyberpress.org

   ShieldBreak Windows Defender Zero-Day Bypasses Microsoft Patch to Gain SYSTEM Access

   cyberpress.org · 62d ago · August 12th, 2026

   The release marks the ninth exploit in the researcher’s 2026 series, and places renewed scrutiny on the resilience of Windows Defender’s core protection components. Rather than introducing an unrelated bug class, ShieldBreak allegedly reaches the same underlying weakness that RoguePlanet exposed: a race condition in the Microsoft Malware Protection Engine. ShieldBreak Windows Defender Zero-Day The claim is significant because Microsoft had already issued a July update intended to address RoguePlanet. RoguePlanet was described as a check-then-act timing issue in mpengine.dll, Defender’s scanning engine. A local attacker could attempt to win the narrow interval between validation and use of a file-related object, redirecting the scanning flow toward attacker-controlled behavior and ultimately launching a command shell under NT AUTHORITY\SYSTEM. Microsoft acknowledged the vulnerability as CVE-2026-50656 , assigned it a CVSS score of 7.8, and characterized exploitation as more likely. The company’s remediation arrived in Malware Protection Engine version 1.1.26060.3008. Nightmare-Eclipse now argues that the update blocked only one route into the vulnerable processing path, rather than removing the broader synchronization fail

4. update from gbhackers.com

   ShieldBreak Windows Defender 0-Day Lets Attackers Bypass Microsoft Patch and Gain SYSTEM Privileges

   gbhackers.com · 62d ago · August 12th, 2026

   ShieldBreak Windows Defender 0-Day The significance of this exploit lies in its ability to target the same underlying weakness […] The post ShieldBreak Windows Defender 0-Day Lets Attackers Bypass Microsoft Patch and Gain SYSTEM Privileges appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

5. update from malware.news

   ShieldBreak: Windows Zero-Day That Breaks Microsoft's RoguePlanet Fix

   malware.news · 62d ago · August 12th, 2026

   Key Findings Tenth tool in an escalating grudge match between the researcher and Microsoft that began in April 2026. This is the first time in the campaign that the researcher has circled back to defeat a patch built specifically to stop them. No kernel bug, no memory corruption, no admin rights required. Confirmed by Howler Cell on a fully patched Windows 11 Pro host. PoC published August 11, 2026 under the MSNightmare handle on GitHub with mirrors on git.projectnightcrawler[.]dev and git.churchofmalware[.]org. No coordinated disclosure, no CVE, no patch. ShieldBreak registers a fake cloud sync provider ("Flubber"), creates a placeholder file named "BERLIN" containing EICAR test content, and baits Defender into scanning via a path routed thr

6. update from malware.news

   Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)

   malware.news · 62d ago · August 12th, 2026

   Threat Summary A critical zero-day vulnerability (CVE-2026-50656/“RoguePlanet”) in Microsoft Defender’s Malware Protection Engine (mpengine.dll) enables local users, including standard, low-privilege accounts, to escalate privileges to NT AUTHORITY\SYSTEM using a race condition and improper link resolution.

7. mentioned by securityweek.com

   Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’

   securityweek.com · 61d ago · August 13th, 2026

8. update from bleepingcomputer.com

   Microsoft working on Defender patch for ShieldBreak zero-day

   bleepingcomputer.com · 57d ago · August 17th, 2026

   ​"Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims," a Microsoft spokesperson told BleepingComputer when asked for a statement regarding the new ShieldBreak zero-day.

9. update from malware.news

   ShieldBreak bypasses Microsoft’s patch for earlier Defender flaw

   malware.news · 57d ago · August 17th, 2026

   Microsoft Defender’s latest patch bypass shows a familiar problem. A newly disclosed Microsoft Defender flaw called ShieldBreak shows that fixing one attack path doesn’t always close every route to the same result. Microsoft says it is still working on a security update. A short timeline At the time, the published exploit for RoguePlanet was described as depending on a race condition, meaning it was not guaranteed to work the same way on every machine. That was one reason the vulnerability was concerning but still somewhat limited from a practical point of view. Microsoft’s July fix should have closed the door on that problem. Sometimes they block one known attack path, while a researcher later finds a different route to reach the same end result. That appears to be what happened he

10. update from blog.qualys.com

    CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days

    blog.qualys.com · 54d ago · August 20th, 2026

    Qualys VMDR provides detection across Windows environments, and Qualys TruRisk Eliminate offers a mitigation that teams can apply now, with affected assets reassessable in VMDR to verify remediation. Microsoft assigned CVE-2026-69414 on August 14, 2026, and is developing a security update; no patch is available yet . What Is ShieldBreak? ShieldBreak targets how Microsoft Defender processes files during cloud-file hydration.