ShieldBreak Zero-Day Lets Local Users Gain SYSTEM via Microsoft Defender

A publicly disclosed zero-day dubbed ShieldBreak (CVE-2026-69414) allows a local attacker with limited privileges to escalate to SYSTEM on Windows systems where Microsoft Defender is enabled. Reporting says the flaw affects the Microsoft Malware Protection Engine and serves as a bypass of Microsoft’s earlier fix for RoguePlanet (CVE-2026-50656), indicating the prior remediation was incomplete. Microsoft has acknowledged the issue and said it is working on a patch, but no release date has been announced.

Technical analysis shows the exploit chains Cloud Files abuse, NT Object Manager namespace manipulation, direct use of Defender functionality through MpClient.dll, a remediation timing race, and Windows Error Reporting task abuse to coerce Defender into writing an attacker-controlled DLL to C:\Windows\System32\phoneinfo.dll, which is then executed by wermgr.exe as SYSTEM. Researchers reproduced the proof of concept on fully patched Windows 11 24H2 and Windows Server 2025 systems with default Defender settings, with elevation reportedly occurring in roughly eight to twelve seconds; key detection opportunities include creation of phoneinfo.dll in System32, MpClient.dll loading by non-Defender processes, suspicious activity under \BaseNamedObjects\Restricted\, and wermgr.exe loading the planted DLL.