Reported by 4 outlets

Timeline

1. original reporting

   Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM

   gbhackers.com · 34d ago · September 9th, 2026

   A newly published proof-of-concept (PoC) called ShieldCrash reveals an unpatched vulnerability in Microsoft Defender that allows a local attacker to gain arbitrary file-read access in the SYSTEM context. This disclosure, attributed to the researcher known as MSNightmare, comes shortly after Microsoft addressed an elevation-of-privilege flaw in the Microsoft Malware Protection Engine, tracked as CVE-2026-69414, referred […] The post Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from bleepingcomputer.com

   Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access

   bleepingcomputer.com · 34d ago · September 9th, 2026

   An anonymous security researcher known as Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldCrash" right after Microsoft rolled out its September 2026 Patch Tuesday security updates.

3. update from cyberpress.org

   Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM

   cyberpress.org · 34d ago · September 9th, 2026

   A newly disclosed proof-of-concept (PoC) dubbed ShieldCrash reportedly enables arbitrary file reads through Microsoft Defender while operating with SYSTEM-level privileges. The issue is described as an incomplete fix for ShieldBreak , tracked as CVE-2026-69414, raising concerns that attackers may still access sensitive files despite Microsoft’s earlier remediation work. According to the MSNightmare, Microsoft corrected several components associated with the original ShieldBreak vulnerability. However, under specific conditions, a remaining code path can reportedly trigger the same underlying class of issue. New Windows Defender ShieldCrash 0-Day The newly named ShieldCrash technique reportedly bypasses the safeguards introduced in the original patch and regains arbitrary file-read capabilities in the Defender security context. The available skeleton PoC reportedly demonstrates reading attacker-selected files as NT AUTHORITY\SYSTEM, the highly privileged Windows account used by core operating-system services and security products. An attacker who can exploit this condition could access data normally unavailable to standard users or even local administrators. Potential targets could include: Registry hive files containing locally stored configuration or credential-related material. Security-product configuration, telemetry, and quarantine data. Files belonging to other user accounts. Application secrets, service configuration files, and database connection strings.

4. mentioned by www.bleepingcomputer.com

   🤖 New Microsoft Defender zero-day "ShieldCrash": public PoC grants SYSTEM access, dropped right after Patch Tuesday. It bypasses the fix for

   www.bleepingcomputer.com · 34d ago · September 9th, 2026

5. mentioned by github.com

   Microsoft has failed to properly patch ShieldBreak CVE-2026-69414, under specific conditions it is still possible to trigger the exact same

   github.com · 34d ago · September 9th, 2026